Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Middleware/SystemPasswordGate.php

@@ -17,7 +17,10 @@ class SystemPasswordGate
             return $next($request);
         }
 
-        if ($request->session()->get('system_password_verified') === true) {
+        // A fingerprint of the current hash: changing the system password ends every earlier verification.
+        $verified = $request->session()->get('system_password_verified');
+
+        if (is_string($verified) && hash_equals(hash('sha256', $systemPassword), $verified)) {
             return $next($request);
         }
 

app/Livewire/FileUploader.php

@@ -192,6 +192,7 @@ class FileUploader extends Component
         ]);
 
         session()->put('pending_shares', array_values(array_diff(session('pending_shares', []), [$share->token])));
+        session()->push('created_shares', $share->token);
 
         // The page the upload leads to offers the password once more, next to the link; it is
         // never stored in the clear, so this flash is the only way it gets there.

app/Livewire/SetupWizard.php

@@ -5,6 +5,7 @@ namespace App\Livewire;
 use App\Models\User;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules\Password;
 use Livewire\Attributes\Layout;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -18,11 +19,20 @@ class SetupWizard extends Component
     #[Validate('required|string|email|max:255|unique:users')]
     public string $email = '';
 
-    #[Validate('required|string|min:8|confirmed')]
     public string $password = '';
 
     public string $password_confirmation = '';
 
+    /**
+     * @return array<string, array<int, mixed>>
+     */
+    protected function rules(): array
+    {
+        return [
+            'password' => ['required', 'string', Password::defaults(), 'confirmed'],
+        ];
+    }
+
     public function mount(): void
     {
         if (User::query()->where('is_admin', true)->exists()) {

app/Livewire/ShareCreated.php

@@ -15,13 +15,15 @@ class ShareCreated extends Component
 {
     public Share $share;
 
-    /** The share's password, offered once to the uploader who just set it; `null` on any other visit. */
+    /** The share's password, offered once to the uploader who just set it; `null` on a reload. */
     #[Locked]
     public ?string $password = null;
 
     public function mount(Share $share): void
     {
-        abort_unless($share->isCompleted(), 404);
+        // Only for the session that created the share, and only while recipients can still reach it.
+        abort_unless($share->isCompleted() && ! $share->isExpired() && ! $share->hasReachedDownloadLimit()
+            && in_array($share->token, session('created_shares', []), true), 404);
 
         $this->share = $share;
 

app/Livewire/ShareDownload.php

@@ -39,10 +39,18 @@ class ShareDownload extends Component
 
     public function verifyPassword(ShareService $shareService): void
     {
-        $rateLimitKey = 'share-password:'.$this->share->token.'|'.request()->ip();
+        $ipKey = 'share-password:'.$this->share->token.'|'.request()->ip();
+        $shareKey = 'share-password:'.$this->share->token;
 
-        if (RateLimiter::tooManyAttempts($rateLimitKey, 5)) {
-            $seconds = RateLimiter::availableIn($rateLimitKey);
+        // Count before the slow hash check, so parallel requests cannot all pass a read-only check.
+        $ipHits = RateLimiter::hit($ipKey, 60);
+        $shareHits = RateLimiter::hit($shareKey, 60);
+
+        if ($ipHits > 5 || $shareHits > 20) {
+            $seconds = max(
+                $ipHits > 5 ? RateLimiter::availableIn($ipKey) : 0,
+                $shareHits > 20 ? RateLimiter::availableIn($shareKey) : 0,
+            );
             $this->addError('password', __('Too many attempts. Please try again in :seconds seconds.', ['seconds' => $seconds]));
 
             return;
@@ -51,13 +59,13 @@ class ShareDownload extends Component
         $this->validate();
 
         if (! $shareService->verifyPassword($this->share, $this->password)) {
-            RateLimiter::hit($rateLimitKey, 60);
             $this->addError('password', __('The password is incorrect.'));
 
             return;
         }
 
-        RateLimiter::clear($rateLimitKey);
+        RateLimiter::clear($ipKey);
+        RateLimiter::clear($shareKey);
 
         $encryptionKey = $shareService->getDecryptionKey($this->share, $this->password);
         session(['share_key_'.$this->share->token => $encryptionKey]);

app/Livewire/SystemPasswordPrompt.php

@@ -4,6 +4,7 @@ namespace App\Livewire;
 
 use App\Models\Setting;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\RateLimiter;
 use Livewire\Attributes\Layout;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -16,6 +17,23 @@ class SystemPasswordPrompt extends Component
 
     public function verify(): void
     {
+        $ipKey = 'system-password|'.request()->ip();
+        $globalKey = 'system-password';
+
+        // Count before the slow hash check, so parallel requests cannot all pass a read-only check.
+        $ipHits = RateLimiter::hit($ipKey, 60);
+        $globalHits = RateLimiter::hit($globalKey, 60);
+
+        if ($ipHits > 5 || $globalHits > 20) {
+            $seconds = max(
+                $ipHits > 5 ? RateLimiter::availableIn($ipKey) : 0,
+                $globalHits > 20 ? RateLimiter::availableIn($globalKey) : 0,
+            );
+            $this->addError('password', __('Too many attempts. Please try again in :seconds seconds.', ['seconds' => $seconds]));
+
+            return;
+        }
+
         $this->validate();
 
         $systemPassword = Setting::get('system_password');
@@ -26,7 +44,10 @@ class SystemPasswordPrompt extends Component
             return;
         }
 
-        session(['system_password_verified' => true]);
+        RateLimiter::clear($ipKey);
+        RateLimiter::clear($globalKey);
+
+        session(['system_password_verified' => hash('sha256', $systemPassword)]);
 
         $this->redirect(route('upload'), navigate: true);
     }

app/Providers/AppServiceProvider.php

@@ -2,12 +2,15 @@
 
 namespace App\Providers;
 
+use App\Http\Middleware\EnsureAdmin;
+use App\Http\Middleware\SystemPasswordGate;
 use App\Models\Setting;
 use Carbon\CarbonImmutable;
 use Illuminate\Support\Facades\Date;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Validation\Rules\Password;
+use Livewire\Livewire;
 use NoNameWeb\LivewireMaterial\Support\Scheme;
 
 class AppServiceProvider extends ServiceProvider
@@ -22,6 +25,9 @@ class AppServiceProvider extends ServiceProvider
         // The colour profile the admin chose in Admin settings; asked each time a page, mail or
         // error page draws its colours, so a new choice applies at once in every Octane worker.
         Scheme::resolveProfileUsing(fn (): ?string => Setting::get('color_profile'));
+
+        // Livewire updates apply a page route's middleware only when it is listed as persistent.
+        Livewire::addPersistentMiddleware([SystemPasswordGate::class, EnsureAdmin::class]);
     }
 
     /**

app/Providers/FortifyServiceProvider.php

@@ -62,7 +62,11 @@ class FortifyServiceProvider extends ServiceProvider
         RateLimiter::for('login', function (Request $request) {
             $throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
 
-            return Limit::perMinute(5)->by($throttleKey);
+            // The address comes from X-Forwarded-For behind the proxy, so a second limit per e-mail does not use it.
+            return [
+                Limit::perMinute(5)->by($throttleKey),
+                Limit::perMinute(20)->by(Str::transliterate(Str::lower($request->input(Fortify::username())))),
+            ];
         });
     }
 }

app/Services/ShareService.php

@@ -10,6 +10,7 @@ use Illuminate\Contracts\Session\Session;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
@@ -104,7 +105,7 @@ class ShareService
      * Verify the encrypted chunk that comes next for a file and write it into place; returns how
      * many of the file's chunks are stored. The plaintext only exists in memory, to be checked.
      *
-     * @throws InvalidArgumentException when the chunk has the wrong length or fails authentication
+     * @throws InvalidArgumentException when the chunk has the wrong length, exceeds the storage quota or fails authentication
      * @throws ModelNotFoundException when the file was removed meanwhile
      */
     public function storeChunk(ShareFile $file, int $index, string $chunk): int
@@ -134,6 +135,10 @@ class ShareService
                 throw new InvalidArgumentException('Chunk '.$index.' has the wrong length');
             }
 
+            if ($this->getTotalUsedSpace() + $plaintextLength > $this->getMaxStorageQuota()) {
+                throw new InvalidArgumentException('Chunk '.$index.' exceeds the storage quota');
+            }
+
             try {
                 $plaintext = $this->encryptionService->decryptChunk($chunk, $share->encryption_key, $noncePrefix, $index, $isLast);
             } catch (RuntimeException) {
@@ -448,11 +453,17 @@ class ShareService
     }
 
     /**
-     * Get total used space in bytes, files still being uploaded included.
+     * Get total used space in bytes; files still being uploaded count with the bytes received so far.
      */
     public function getTotalUsedSpace(): int
     {
-        return (int) Share::query()->sum('total_size');
+        $chunkSize = (int) config('uploads.chunk_size');
+
+        $received = ShareFile::query()
+            ->whereHas('share', fn ($query) => $query->whereNull('completed_at'))
+            ->sum(DB::raw("CASE WHEN uploaded_chunks * {$chunkSize} < file_size THEN uploaded_chunks * {$chunkSize} ELSE file_size END"));
+
+        return (int) Share::query()->whereNotNull('completed_at')->sum('total_size') + (int) $received;
     }
 
     /**