Where the old password is stored?

[evanasc]

I consulted the Teampass database to better understand the structure of its tables and during the analysis I found the following question: where is the old password stored?

When the user changes the password to access the items, the following screen appears:

Note: I saw that the keypass_users table stores the new password in the "pw" field which is updated during the first access with the new password:

describe keypass_users;
+------------------------+---------------+------+-----+-------------+----------------+
| Field | Type | Null | Key | Default | Extra |
+------------------------+---------------+------+-----+-------------+----------------+
| id | int | NO | PRI | NULL | auto_increment |
| login | varchar(500) | NO | UNI | NULL | |
| pw | varchar(400) | NO | | NULL | |
| groupes_visibles | varchar(1000) | NO | | NULL | |
| derniers | text | YES | | NULL | |
| key_tempo | varchar(100) | YES | | NULL | |
| last_pw_change | varchar(30) | YES | | NULL | |
| last_pw | text | YES | | NULL | |
| admin | tinyint(1) | NO | | 0 | |
| fonction_id | varchar(1000) | YES | | NULL | |
| groupes_interdits | varchar(1000) | YES | | NULL | |
| last_connexion | varchar(30) | YES | | NULL | |
| gestionnaire | int | NO | | 0 | |
| email | varchar(300) | NO | | none | |
| favourites | varchar(1000) | YES | | NULL | |
| latest_items | varchar(1000) | YES | | NULL | |
| personal_folder | int | NO | | 0 | |
| disabled | tinyint(1) | NO | | 0 | |
| can_create_root_folder | tinyint(1) | NO | | 0 | |
| read_only | tinyint(1) | NO | | 0 | |
| timestamp | varchar(30) | NO | | 0 | |
| user_language | varchar(50) | NO | | 0 | |
| name | varchar(100) | YES | | NULL | |
| lastname | varchar(100) | YES | | NULL | |
| session_end | varchar(30) | YES | | NULL | |
| isAdministratedByRole | tinyint | NO | | 0 | |
| psk | varchar(400) | YES | | NULL | |
| ga | varchar(50) | YES | | NULL | |
| ga_temporary_code | varchar(20) | NO | | none | |
| avatar | varchar(1000) | YES | | NULL | |
| avatar_thumb | varchar(1000) | YES | | NULL | |
| upgrade_needed | tinyint(1) | NO | | 0 | |
| treeloadstrategy | varchar(30) | NO | | full | |
| can_manage_all_users | tinyint(1) | NO | | 0 | |
| usertimezone | varchar(50) | NO | | not_defined | |
| agses-usercardid | varchar(50) | NO | | 0 | |
| encrypted_psk | text | YES | | NULL | |
| user_ip | varchar(400) | NO | | none | |
| user_ip_lastdate | varchar(50) | YES | | NULL | |
| yubico_user_key | varchar(100) | NO | | none | |
| yubico_user_id | varchar(100) | NO | | none | |
| public_key | text | YES | | NULL | |
| private_key | text | YES | | NULL | |
| special | varchar(250) | NO | | none | |
| auth_type | varchar(200) | NO | | local | |
| is_ready_for_usage | tinyint(1) | NO | | 0 | |
| otp_provided | tinyint(1) | NO | | 0 | |
| roles_from_ad_groups | varchar(1000) | YES | | NULL | |
| ongoing_process_id | varchar(100) | YES | | NULL | |
| mfa_enabled | tinyint(1) | NO | | 1 | |
| created_at | varchar(30) | YES | | NULL | |
| updated_at | varchar(30) | YES | | NULL | |
| deleted_at | varchar(30) | YES | | NULL | |
| keys_recovery_time | varchar(500) | YES | | NULL | |
| aes_iv | text | YES | | NULL | |
| split_view_mode | tinyint(1) | NO | | 0 | |
+------------------------+---------------+------+-----+-------------+----------------+
56 rows in set (0.00 sec)

However, I couldn't find where the previous password is stored so that the user can enter it.

Can someone help me?

[corentin-soriano]

For security reasons, the user's password is not stored anywhere.
To verify the old password, we simply try to decrypt the private key (private_key field) with the password provided in the form.

If the user has lost their old password, they must restore their keys or regenerate them (but this will erase all passwords from the personal folder):


Red: Always provide current user password.
White: Provide user private and public keys if possible.
Green: Check this only if you don't have the keys.

[evanasc]

In the version of Teampass that is in production, after entering the password, on this screen, no other action occurs when clicking Run.

According to the previous comment, should another screen open with this content?

In my case they don't appear. Is there any way to identify what might be happening... whether it's a missing dependency or a problem with version 3.1.4.4?

[corentin-soriano]

I think I understood: The "personal folder" feature is not active on your instance?
If this is the case, it is normal and you can continue without these additional fields.