How admin user can see all passwords?

Community Feedback
1

i want to see all passwords from other users? please tell me how to do this?
i known, all users is own their passwords, other can see only if they share it. But i looking the source code. & i put customize some code to test:

$this->loadModel('Resources');
$this->loadModel('Users');
$this->loadModel('Permissions');
$this->loadModel('Secrets');

$resource_id='e0e5ad5a-7b25-4862-a5de-3e6743e7e862';
$user_id='dcd2747b-0031-43c2-8dfc-5a9e6d53370f';
	
$resource = $this->Resources->get($resource_id, ['contain' => ['Permissions', 'Secrets']]);
$permission = $this->addPermission('Resource', $resource_id, 'User', $user_id, Permission::UPDATE);

$secretdata='-----BEGIN PGP MESSAGE-----
Version: OpenPGP.js v4.5.1
Comment: https://openpgpjs.org

wcBMA4tobAoWcYLhAQgAsXLoFiVUL5Bb6hnpTf+z2IPoytIr8zArPy4CtwXg
iOW2VERx4IaHRJKIDo06Yh3yzeymlmIvovBKe15KJoPRq2+eLU9lf0liVGKi
4GHBy5/J6g/zfdUCQtbLYqo2fP6CJCFLEzIBD4D6E0lQgc+CdKkcqj1EYfGX
OOQtH3NWr62JvPmpBq5puQqT9cfzFSy8Vje0NYrvl71Ixu3iuHp0lFfRQsIA
HEEzO7cshTgCa4SyDgJ669w0G/qkZMAFssOoNTc49zW1myt5OuCQwn7QTlt6
MMe9JudD+PSA1+ZmrZnZGHuDGMFM4FOzb7O9HqgK/9ShPrqZXmHJeccbQd1B
DdI8AUfYb8Y1YDHSznoZ0m5qNi/UaHO8fBD+y0se6UH4gCJFX7Gdobuye3WR
3QXPo9qfG6yvqbqrRKkswZ72
=oaq0
-----END PGP MESSAGE-----';

$data = [
		'permissions'=>[
			Array
			(
				//'id' => $permission->id,
				'is_new'=>1,
				'aco' => 'Resource',
				'aco_foreign_key' => $permission->aco_foreign_key,
				'aro' => 'User',
				'aro_foreign_key' => $permission->aro_foreign_key,
				'type' => $permission->type,			
			)
		],
		'secrets'=>[
			[
				'resource_id' => $resource_id,
				'user_id' => $user_id,
				'data' => $secretdata
			]
		]
	];
if(!$this->Resources->share($resource, $data['permissions'], $data['secrets'])) {
		$errors = $resource->getErrors();
			if (!empty($errors)) {
				print_r($errors);
			}
	}

but i got the error:
The secrets of all the users having access to the resource are required

please help!!

2

As far as I know, the passwords are encrypted in db with user keys. One record for each user that has permissions with its own key encryption, so you can’t modify anything in db or code to view the passwords your user doesn´t have.

I’ve been trying something similar: change code to automaticly share with the admin user every password created/modified in the system (escrow functionallity), but I haven´t got it. I think it’s about some plugin share action I can´t replicate from server code.

Any other idea?