Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/FileUploadTest.php

@@ -7,6 +7,7 @@ use App\Models\Share;
 use App\Models\ShareFile;
 use App\Services\ShareService;
 use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Storage;
 use Livewire\Features\SupportTesting\Testable;
 use Livewire\Livewire;
@@ -54,14 +55,33 @@ test('upload page requires system password when configured', function () {
 });
 
 test('upload page accessible after system password verified', function () {
-    Setting::set('system_password', bcrypt('system-secret'));
+    $systemPassword = bcrypt('system-secret');
+    Setting::set('system_password', $systemPassword);
 
-    $response = $this->withSession(['system_password_verified' => true])
+    $response = $this->withSession(['system_password_verified' => hash('sha256', $systemPassword)])
         ->get(route('upload'));
 
     $response->assertOk();
 });
 
+test('a verification of an earlier system password no longer opens the upload page', function () {
+    $oldSystemPassword = bcrypt('system-secret');
+    Setting::set('system_password', $oldSystemPassword);
+    $this->withSession(['system_password_verified' => hash('sha256', $oldSystemPassword)]);
+
+    Setting::set('system_password', bcrypt('new-system-secret'));
+
+    $this->get(route('upload'))->assertRedirect(route('system-password'));
+});
+
+test('a verification stored before 2.4.2 no longer opens the upload page', function () {
+    Setting::set('system_password', bcrypt('system-secret'));
+
+    $this->withSession(['system_password_verified' => true])
+        ->get(route('upload'))
+        ->assertRedirect(route('system-password'));
+});
+
 test('file upload creates share', function () {
     Storage::fake('shares');
     $component = Livewire::test(FileUploader::class);
@@ -74,6 +94,7 @@ test('file upload creates share', function () {
     expect($share->isCompleted())->toBeTrue();
     expect($share->files->pluck('original_name')->all())->toBe(['document.pdf']);
     expect(session('pending_shares'))->not->toContain($share->token);
+    expect(session('created_shares'))->toBe([$share->token]);
 });
 
 test('registering files hands the browser each file\'s chunk URL, the share key and the file\'s nonce prefix', function () {
@@ -377,6 +398,27 @@ test('file upload blocks when storage is full', function () {
     expect(ShareFile::query()->count())->toBe(0);
 });
 
+test('files declared by one session without any chunk do not block another session', function () {
+    Storage::fake('shares');
+    Setting::set('max_file_size', 200 * 1024 * 1024);
+    Setting::set('max_size_per_share', 1024 * 1024 * 1024);
+    Setting::set('max_files_per_share', 10);
+    Setting::set('max_storage_quota', 300 * 1024 * 1024);
+
+    Livewire::test(FileUploader::class)->call('registerFiles', [
+        ['name' => 'a.bin', 'size' => 100 * 1024 * 1024, 'path' => null],
+        ['name' => 'b.bin', 'size' => 100 * 1024 * 1024, 'path' => null],
+        ['name' => 'c.bin', 'size' => 100 * 1024 * 1024, 'path' => null],
+    ])->assertHasNoErrors('files');
+
+    session()->flush();
+    $component = Livewire::test(FileUploader::class)
+        ->call('registerFiles', [['name' => 'd.txt', 'size' => 1024, 'path' => null]]);
+
+    $component->assertHasNoErrors('files');
+    expect(ShareFile::query()->count())->toBe(4);
+});
+
 test('system password prompt verifies correct password', function () {
     Setting::set('system_password', bcrypt('system-secret'));
 
@@ -394,3 +436,38 @@ test('system password prompt rejects incorrect password', function () {
         ->call('verify')
         ->assertHasErrors(['password']);
 });
+
+test('the system password prompt refuses a sixth attempt from the same address, even with the correct password', function () {
+    Setting::set('system_password', bcrypt('system-secret'));
+
+    $component = Livewire::test(SystemPasswordPrompt::class);
+
+    for ($i = 0; $i < 5; $i++) {
+        $component->set('password', 'wrong')
+            ->call('verify')
+            ->assertHasErrors(['password']);
+    }
+
+    $component->set('password', 'system-secret')
+        ->call('verify')
+        ->assertHasErrors(['password'])
+        ->assertSee('Too many attempts')
+        ->assertNoRedirect();
+});
+
+test('the global system password limit refuses the correct password from any address', function () {
+    Setting::set('system_password', bcrypt('system-secret'));
+
+    for ($i = 0; $i < 20; $i++) {
+        RateLimiter::hit('system-password', 60);
+    }
+
+    Livewire::test(SystemPasswordPrompt::class)
+        ->set('password', 'system-secret')
+        ->call('verify')
+        ->assertHasErrors(['password'])
+        ->assertSee('Too many attempts')
+        ->assertNoRedirect();
+
+    expect(session()->has('system_password_verified'))->toBeFalse();
+});