Argument passed to Crypto::decrypt() must be of the type string, null given

[Charburner]

I have two servers running Nextcloud 14.0.9 and Nextcloud 16.0.1 with multiple customers. Following exception occurs from time to time on both servers:

Argument 1 passed to OC\Security\Crypto::decrypt() must be of the type string, null given

Is this a known issue and can it be fixed? Or should I ignore it?

Here is an full example of the latest entry in nextcloud.log:

"{"reqId":"XQxAD3d9Mj0szT180ZCCZAAAAAo","level":3,"time":"2019-06-21T04:25:19+02:00","remoteAddr":"1.2.3.4","user":"--","app":"index","method":"GET","url":"\/subdir\/lostpassword\/reset\/form\/D7RbNPtM56zzc3o9y5xHS\/customer_username","message":{"Exception":"TypeError","Message":"Argument 1 passed to OC\Security\Crypto::decrypt() must be of the type string, null given, called in \/var\/www\/subdir\/core\/Controller\/LostController.php on line 184","Code":0,"Trace":[{"file":"\/var\/www\/subdir\/core\/Controller\/LostController.php","line":184,"function":"decrypt","class":"OC\Security\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"\/var\/www\/subdir\/core\/Controller\/LostController.php","line":150,"function":"checkPasswordResetToken","class":"OC\Core\Controller\LostController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"\/var\/www\/subdir\/lib\/private\/AppFramework\/Http\/Dispatcher.php","line":166,"function":"resetform","class":"OC\Core\Controller\LostController","type":"->","args":["*** sensitive parameter replaced ***","*** sensitive parameter replaced ***"]},{"file":"\/var\/www\/subdir\/lib\/private\/AppFramework\/Http\/Dispatcher.php","line":99,"function":"executeController","class":"OC\AppFramework\Http\Dispatcher","type":"->","args":[{"__class__":"OC\Core\Controller\LostController"},"resetform"]},{"file":"\/var\/www\/subdir\/lib\/private\/AppFramework\/App.php","line":118,"function":"dispatch","class":"OC\AppFramework\Http\Dispatcher","type":"->","args":[{"__class__":"OC\Core\Controller\LostController"},"resetform"]},{"file":"\/var\/www\/subdir\/lib\/private\/AppFramework\/Routing\/RouteActionHandler.php","line":47,"function":"main","class":"OC\AppFramework\App","type":"::","args":["OC\Core\Controller\LostController","resetform",{"__class__":"OC\AppFramework\DependencyInjection\DIContainer"},{"token":"*** sensitive parameter replaced ***","userId":"*** sensitive parameter replaced ***","_route":"core.lost.resetform"}]},{"function":"__invoke","class":"OC\AppFramework\Routing\RouteActionHandler","type":"->","args":[{"token":"*** sensitive parameter replaced ***","userId":"*** sensitive parameter replaced ***","_route":"core.lost.resetform"}]},{"file":"\/var\/www\/subdir\/lib\/private\/Route\/Router.php","line":297,"function":"call_user_func","args":[{"__class__":"OC\AppFramework\Routing\RouteActionHandler"},{"token":"*** sensitive parameter replaced ***","userId":"*** sensitive parameter replaced ***","_route":"core.lost.resetform"}]},{"file":"\/var\/www\/subdir\/lib\/base.php","line":987,"function":"match","class":"OC\Route\Router","type":"->","args":["\/lostpassword\/reset\/form\/D7RbNPtM56zzc3o9y5xHS\/customer_username"]},{"file":"\/var\/www\/subdir\/index.php","line":42,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"\/var\/www\/subdir\/lib\/private\/Security\/Crypto.php","Line":113,"CustomMessage":"--"},"userAgent":"Mozilla\/5.0 (Windows NT 6.1: Win64: x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36","version":"14.0.9.1"}")

Server configuration

Operating system: CentOS 7

Web server: Apache 2.4

Database: MariaDB

PHP version: 7.1.8

Nextcloud version: 14.0.9 and 16.0.1

Updated from an older Nextcloud/ownCloud or fresh install: Updated several times since Nextcloud 11 I guess

[ChristophWurst]

Sounds like there is a null check missing. If no "lostpassword" token is set, null is used as default. But that is incompatible to the following operations.

[assysttest]

I'm watching the issue here too, Nextcloud 16.0.5. The line number has been changed:

"Exception":"TypeError","Message":"Argument 1 passed to OC\\Security\\Crypto::decrypt() must be of the type string, null given, called in \/var\/www\/html\/nextcloud\/core\/Controller\/LostController.php on line 192","Code":0,"Trace":[{"file":"\/var\/www\/html\/nextcloud\/core\/Controller\/LostController.php","line":192,"function":"decrypt"

Could be that the token to reset the password is old. The error message visible for the user is realy strange.

[kesselb]

#16782 (Nextcoud 17) / #17648 (Nextcloud 16.0.6)