Release 2.4.2

Fixes the nine findings of a security audit of 2.4.1. The most
important: an anonymous uploader could fill the storage quota without
sending data, and a forged X-Forwarded-For header could get around the
limits on password attempts. Password attempts now also have a limit
per share, per login e-mail and for the system password.

Whoever entered the system password enters it once more after the
update. Update now: docker compose pull and docker compose up -d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.2] - 2026-10-22
+
+### Changed
+
+- Whoever entered the system password enters it once more after the update. A change of the system password now ends every earlier entry.
+- The page after an upload, with the link and the QR code, opens only in the browser session that created the share, and only while the share can still be downloaded. Other visitors get "not found".
+- The admin password in the setup wizard follows the same rules as a changed password (in production: at least 12 characters, upper and lower case, numbers and symbols).
+
+### Fixed
+
+- Security: an anonymous uploader could reserve the whole storage quota with declared file sizes and send no data. Uploads that are not complete now count only the bytes received, and a chunk that goes above the quota is refused.
+- Security: password attempts are limited per share, per login e-mail and for the system password (20 per minute), in addition to the limit per address (5 per minute), which a forged `X-Forwarded-For` header could change. The share password limit counts an attempt before the check, so parallel attempts cannot pass it. The system password had no limit.
+- Security: the system password also protects the upload page's actions, so a page opened before the system password was set cannot register files.
+- Security: the page after an upload showed a share's details to everyone with its link, also for a password-protected or expired share.
+- Security: a password change or reset signs the admin's other sessions out.
+- Security: the only admin can no longer delete their account, which opened the setup page to every visitor.
+
 ## [2.4.1] - 2026-10-22
 
 ### Changed
@@ -210,6 +227,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Dark themed UI built with Livewire, Alpine.js, Tailwind CSS and DaisyUI.
 - Docker images published to `ghcr.io/surtic86/sealshare`, served by FrankenPHP via Laravel Octane.
 
+[2.4.2]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.4.1...v2.4.2
 [2.4.1]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.4.0...v2.4.1
 [2.4.0]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.3.0...v2.4.0
 [2.3.0]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.2.0...v2.3.0

config/app.php

@@ -25,6 +25,6 @@ return [
     |
     */
 
-    'version' => '2.4.1',
+    'version' => '2.4.2',
 
 ];