noNameWEB/SealShare
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 8 Wiki Activity

Fix the security audit's findings

Browse Source 
Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
surtic86
2026-10-22 14:46:38 +02:00
co-authored by Claude Opus 5.5
parent 014184c824
commit 84c8b81f0a
26 changed files with 566 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resources/views/pages/settings/⚡delete-user-form.blade.php
+48 -17
View File
@@ -2,7 +2,9 @@
use App\Concerns\PasswordValidationRules;
use App\Livewire\Actions\Logout;
use App\Models\User;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\DB;
use Livewire\Component;
new class extends Component {
@@ -12,7 +14,15 @@ new class extends Component {
public bool $showDeleteModal = false;
/**
* Delete the currently authenticated user.
* Whether the user is the only admin: deleting that account would open /setup to anyone.
*/
public function isLastAdmin(): bool
{
return Auth::user()->is_admin && ! User::query()->where('is_admin', true)->whereKeyNot(Auth::id())->exists();
}
/**
* Delete the currently authenticated user, unless it is the only admin.
*/
public function deleteUser(Logout $logout): void
{
@@ -20,29 +30,50 @@ new class extends Component {
'password' => $this->currentPasswordRules(),
]);
tap(Auth::user(), $logout(...))->delete();
// The admin rows stay locked until the delete, so two admins cannot delete each other's last peer at once.
$deleted = DB::transaction(function () use ($logout): bool {
User::query()->where('is_admin', true)->lockForUpdate()->get();
if ($this->isLastAdmin()) {
return false;
}
tap(Auth::user(), $logout(...))->delete();
return true;
});
if (! $deleted) {
$this->addError('password', __('You are the only admin, so this account cannot be deleted.'));
return;
}
$this->redirect('/', navigate: true);
}
}; ?>
<x-card :title="__('Delete account')" :subtitle="__('Delete your account and all of its resources')" heading="h2" variant="outlined">
<x-button :label="__('Delete account')" danger icon="delete" wire:click="$set('showDeleteModal', true)" data-test="delete-user-button" />
@if ($this->isLastAdmin())
<p class="md-type-body-md md-ink-variant">{{ __('You are the only admin, so this account cannot be deleted.') }}</p>
@else
<x-button :label="__('Delete account')" danger icon="delete" wire:click="$set('showDeleteModal', true)" data-test="delete-user-button" />
<x-modal wire:model="showDeleteModal" :title="__('Are you sure you want to delete your account?')" icon="delete">
<x-stack gap="space200">
<p>
{{ __('Once your account is deleted, all of its resources and data will be permanently deleted. Please enter your password to confirm you would like to permanently delete your account.') }}
</p>
<x-modal wire:model="showDeleteModal" :title="__('Are you sure you want to delete your account?')" icon="delete">
<x-stack gap="space200">
<p>
{{ __('Once your account is deleted, all of its resources and data will be permanently deleted. Please enter your password to confirm you would like to permanently delete your account.') }}
</p>
<x-form id="delete-user-form" wire:submit="deleteUser">
<x-password wire:model="password" :label="__('Password')" autocomplete="current-password" />
</x-form>
</x-stack>
<x-form id="delete-user-form" wire:submit="deleteUser">
<x-password wire:model="password" :label="__('Password')" autocomplete="current-password" />
</x-form>
</x-stack>
<x-slot:actions>
<x-button :label="__('Cancel')" x-on:click="close()" />
<x-button type="submit" form="delete-user-form" :label="__('Delete account')" danger data-test="confirm-delete-user-button" />
</x-slot:actions>
</x-modal>
<x-slot:actions>
<x-button :label="__('Cancel')" x-on:click="close()" />
<x-button type="submit" form="delete-user-form" :label="__('Delete account')" danger data-test="confirm-delete-user-button" />
</x-slot:actions>
</x-modal>
@endif
</x-card>