apps/files_encryption/ajax/userrecovery.php: $return=$util->setRecoveryForUser($_POST['userEnableRecovery']);

There has to be clear input validation - what is setRecoveryForUser() expecting? 
In case something unexpected is received -> throw an exception and bye-bye.