From 98dc942967cfc191bded8abaa82103ecd85c12df Mon Sep 17 00:00:00 2001
From: Mikael Mello <mikaelm@lacunasoftware.com>
Date: Mon, 12 Nov 2018 10:25:50 -0200
Subject: [PATCH 1/2] Require confirmation of UI password when updating it

---
 .../scripts/controllers/SystemSettingsController.js | 13 ++++++++-----
 .../Server/webroot/ngax/templates/settings.html     |  6 +++++-
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js b/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js
index 7c34ef6ac..bc9eb5202 100644
--- a/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js
+++ b/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js
@@ -1,4 +1,4 @@
-backupApp.controller('SystemSettingsController', function($rootScope, $scope, $location, $cookies, AppService, AppUtils, SystemInfo, gettextCatalog) {
+backupApp.controller('SystemSettingsController', function($rootScope, $scope, $location, $cookies, AppService, DialogService, AppUtils, SystemInfo, gettextCatalog) {
 
     $scope.SystemInfo = SystemInfo.watch($scope);    
     $scope.theme = $scope.$parent.$parent.saved_theme;
@@ -53,6 +53,7 @@ backupApp.controller('SystemSettingsController', function($rootScope, $scope, $l
 
         $scope.requireRemotePassword = data.data['server-passphrase'] != null && data.data['server-passphrase'] != '';
         $scope.remotePassword = data.data['server-passphrase'];
+        $scope.confirmPassword = '';
         $scope.allowRemoteAccess = data.data['server-listen-interface'] != 'loopback';
         $scope.startupDelayDurationValue = data.data['startup-delay'].substr(0, data.data['startup-delay'].length - 1) == "" ? "0" : data.data['startup-delay'].substr(0, data.data['startup-delay'].length - 1);
         $scope.startupDelayDurationMultiplier = data.data['startup-delay'].substr(-1) == "" ? "s" : data.data['startup-delay'].substr(-1);
@@ -84,11 +85,13 @@ backupApp.controller('SystemSettingsController', function($rootScope, $scope, $l
             'disable-tray-icon-login': $scope.disableTrayIconLogin
         };
 
-        if ($scope.requireRemotePassword) {
-            if ($scope.rawdata['server-passphrase'] != $scope.remotePassword) {
-                patchdata['server-passphrase-salt'] =  CryptoJS.lib.WordArray.random(256/8).toString(CryptoJS.enc.Base64);
-                patchdata['server-passphrase'] = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Utf8.parse($scope.remotePassword) + CryptoJS.enc.Base64.parse(patchdata['server-passphrase-salt']))).toString(CryptoJS.enc.Base64);
+        if ($scope.requireRemotePassword && $scope.rawdata['server-passphrase'] != $scope.remotePassword) {
+            if ($scope.remotePassword != $scope.confirmPassword) {
+                AppUtils.notifyInputError(gettextCatalog.getString('The passwords do not match'));
+                return;
             }
+            patchdata['server-passphrase-salt'] =  CryptoJS.lib.WordArray.random(256/8).toString(CryptoJS.enc.Base64);
+            patchdata['server-passphrase'] = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Utf8.parse($scope.remotePassword) + CryptoJS.enc.Base64.parse(patchdata['server-passphrase-salt']))).toString(CryptoJS.enc.Base64);
         } else {
             patchdata['server-passphrase-salt'] = null;
             patchdata['server-passphrase'] = null;
diff --git a/Duplicati/Server/webroot/ngax/templates/settings.html b/Duplicati/Server/webroot/ngax/templates/settings.html
index 2924efafc..64ee5a7eb 100644
--- a/Duplicati/Server/webroot/ngax/templates/settings.html
+++ b/Duplicati/Server/webroot/ngax/templates/settings.html
@@ -5,9 +5,13 @@
         <h2 translate>Access to user interface</h2>
         <div class="input mixed multiple">
             <input type="checkbox" class="checkbox" id="hasPassword" name="hasPassword" ng-model="requireRemotePassword" />
-            <label for="password" translate>Password</label>
+            <label for="password" translate>Password</label><br>
             <input type="password" id="password" name="password" ng-model="remotePassword" />
         </div>
+        <div class="input mixed multiple">
+            <label for="confirm-password" translate>Confirm password</label><br>
+            <input type="password" id="confirm-password" name="confirm-password" ng-model="confirmPassword" autocomplete="new-password" />
+        </div>
         <div class="input checkbox">
             <input type="checkbox" class="checkbox" id="remote" name="remote" ng-model="allowRemoteAccess" />
             <label for="remote" translate>Allow remote access (requires restart)</label>     

From e7b3a7fc315400e528c6ce984df318057c1da55f Mon Sep 17 00:00:00 2001
From: Mikael Mello <mikaelm@lacunasoftware.com>
Date: Tue, 13 Nov 2018 08:17:43 -0200
Subject: [PATCH 2/2] Set passwords to null only when the Password checkbox is
 unmarked

---
 .../ngax/scripts/controllers/SystemSettingsController.js        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js b/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js
index bc9eb5202..f1a5b2fa5 100644
--- a/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js
+++ b/Duplicati/Server/webroot/ngax/scripts/controllers/SystemSettingsController.js
@@ -92,7 +92,7 @@ backupApp.controller('SystemSettingsController', function($rootScope, $scope, $l
             }
             patchdata['server-passphrase-salt'] =  CryptoJS.lib.WordArray.random(256/8).toString(CryptoJS.enc.Base64);
             patchdata['server-passphrase'] = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Utf8.parse($scope.remotePassword) + CryptoJS.enc.Base64.parse(patchdata['server-passphrase-salt']))).toString(CryptoJS.enc.Base64);
-        } else {
+        } else if (!$scope.requireRemotePassword) {
             patchdata['server-passphrase-salt'] = null;
             patchdata['server-passphrase'] = null;
         }