Release 2.3.0

A share can now hold a private text (a password, a key, a short note)
with its files or on its own. The upload page's new "Private text" card
takes up to 100 KB; the browser encrypts the text and sends it through
the same chunk pipeline as a file, flagged is_text on share_files, so it
gets the share's password, expiry, download limit and cleanup.

The recipient sees the text only after pressing "Show text", which
counts as their download, so a messenger link preview cannot use up a
share limited to one download. The text is left out of the file list,
the ZIP and the file counts; the admin dashboard marks shares that hold
one with "Text".

The website gains a Private text feature card and a fifth phone
screenshot; every screenshot is retaken.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Services/ShareService.php

@@ -17,6 +17,7 @@ use Illuminate\Validation\ValidationException;
 use InvalidArgumentException;
 use League\MimeTypeDetection\FinfoMimeTypeDetector;
 use RuntimeException;
+use Symfony\Component\HttpKernel\Exception\HttpException;
 
 /**
  * A share's life: files registered into a pending share, their encrypted chunks stored as the
@@ -35,11 +36,13 @@ class ShareService
 
     /**
      * Register a file the uploader's browser is about to send, in the given pending share or in a
-     * new one, and write its encrypted file's header.
+     * new one, and write its encrypted file's header. The share's private text is registered the
+     * same way, as `text.txt` with `$isText`: it is capped at ShareFile::MAX_TEXT_BYTES and does not
+     * count as one of the share's files.
      *
      * @throws ValidationException when the file breaks an admin limit
      */
-    public function registerFile(?Share $pendingShare, string $name, int $size, ?string $relativePath): ShareFile
+    public function registerFile(?Share $pendingShare, string $name, int $size, ?string $relativePath, bool $isText = false): ShareFile
     {
         $maxFileSize = (int) Setting::get('max_file_size', 100 * 1024 * 1024);
         $maxFilesPerShare = (int) Setting::get('max_files_per_share', 50);
@@ -49,7 +52,11 @@ class ShareService
             $this->rejectFile(__('The file could not be added.'));
         }
 
-        if ($size > $maxFileSize) {
+        if ($isText && ($size < 1 || $size > ShareFile::MAX_TEXT_BYTES)) {
+            $this->rejectFile(__('The text is too long (maximum 100 KB).'));
+        }
+
+        if (! $isText && $size > $maxFileSize) {
             $this->rejectFile(__('":name" is too large (:size MB). Maximum file size is :max MB.', [
                 'name' => $name,
                 'size' => round($size / (1024 * 1024), 1),
@@ -57,7 +64,7 @@ class ShareService
             ]));
         }
 
-        if ($pendingShare && $pendingShare->files()->count() >= $maxFilesPerShare) {
+        if (! $isText && $pendingShare && $pendingShare->files()->where('is_text', false)->count() >= $maxFilesPerShare) {
             $this->rejectFile(__('Too many files. Maximum :max files allowed per share.', ['max' => $maxFilesPerShare]));
         }
 
@@ -85,6 +92,7 @@ class ShareService
             'relative_path' => $this->sanitizeRelativePath($relativePath),
             'stored_path' => 'shares/'.$share->token.'/'.$storedName,
             'file_size' => $size,
+            'is_text' => $isText,
         ]);
 
         $share->increment('total_size', $size);
@@ -192,14 +200,14 @@ class ShareService
         $maxSizePerShare = (int) Setting::get('max_size_per_share', 2 * 1024 * 1024 * 1024);
 
         if ($files->isEmpty()) {
-            $this->rejectFile(__('Please select at least one file to upload.'));
+            $this->rejectFile(__('Add files or a text to share.'));
         }
 
         if ($files->contains(fn (ShareFile $file): bool => $file->completed_at === null)) {
             $this->rejectFile(__('Wait until every file has finished uploading, or remove the ones that failed.'));
         }
 
-        if ($files->count() > $maxFilesPerShare) {
+        if ($files->where('is_text', false)->count() > $maxFilesPerShare) {
             $this->rejectFile(__('Too many files. Maximum :max files allowed per share.', ['max' => $maxFilesPerShare]));
         }
 
@@ -223,13 +231,13 @@ class ShareService
     }
 
     /**
-     * Create a share from files already on the server, through the same steps an upload from the
-     * browser takes. Used by tests and demo data.
+     * Create a share from files already on the server, and optionally a private text, through the
+     * same steps an upload from the browser takes. Used by tests and demo data.
      *
      * @param  array<int, array{file: UploadedFile, relativePath: string|null}>  $files
      * @param  array{password?: string|null, expires_at?: mixed, max_downloads?: int|null}  $options
      */
-    public function createShare(array $files, array $options = []): Share
+    public function createShare(array $files, array $options = [], ?string $text = null): Share
     {
         $share = null;
 
@@ -238,34 +246,92 @@ class ShareService
             $shareFile = $this->registerFile($share, $file->getClientOriginalName(), $file->getSize(), $fileData['relativePath'] ?? null);
             $share = $shareFile->share;
 
-            $header = $this->readHeader($shareFile);
             $source = fopen($file->getRealPath(), 'rb');
+            $this->storeContent($shareFile, $source);
+            fclose($source);
+        }
 
-            for ($index = 0; $index < $header['chunkCount']; $index++) {
-                $plaintextLength = min($header['chunkSize'], $shareFile->file_size - $index * $header['chunkSize']);
-
-                // A fake upload reports a size its content does not have: zeros make up the rest.
-                $chunk = $this->encryptionService->encryptChunk(
-                    str_pad($plaintextLength > 0 ? (string) fread($source, $plaintextLength) : '', $plaintextLength, "\0"),
-                    $share->encryption_key,
-                    $header['noncePrefix'],
-                    $index,
-                    $index === $header['chunkCount'] - 1,
-                );
-
-                $this->storeChunk($shareFile->refresh(), $index, $chunk);
-            }
+        if ($text !== null && $text !== '') {
+            $shareFile = $this->registerFile($share, 'text.txt', strlen($text), null, isText: true);
+            $share = $shareFile->share;
 
+            $source = fopen('php://memory', 'r+b');
+            fwrite($source, $text);
+            rewind($source);
+            $this->storeContent($shareFile, $source);
             fclose($source);
         }
 
         if ($share === null) {
-            $this->rejectFile(__('Please select at least one file to upload.'));
+            $this->rejectFile(__('Add files or a text to share.'));
         }
 
         return $this->completeShare($share, $options);
     }
 
+    /**
+     * Encrypt a registered file's content chunk by chunk from a stream and store the chunks, as the
+     * uploader's browser would.
+     *
+     * @param  resource  $source
+     */
+    private function storeContent(ShareFile $shareFile, $source): void
+    {
+        $share = $shareFile->share;
+        $header = $this->readHeader($shareFile);
+
+        for ($index = 0; $index < $header['chunkCount']; $index++) {
+            $plaintextLength = min($header['chunkSize'], $shareFile->file_size - $index * $header['chunkSize']);
+
+            // A fake upload reports a size its content does not have: zeros make up the rest.
+            $chunk = $this->encryptionService->encryptChunk(
+                str_pad($plaintextLength > 0 ? (string) fread($source, $plaintextLength) : '', $plaintextLength, "\0"),
+                $share->encryption_key,
+                $header['noncePrefix'],
+                $index,
+                $index === $header['chunkCount'] - 1,
+            );
+
+            $this->storeChunk($shareFile->refresh(), $index, $chunk);
+        }
+    }
+
+    /**
+     * A share's private text, decrypted in memory with the share's key; null when it has none.
+     */
+    public function readText(Share $share, string $key): ?string
+    {
+        $textFile = $share->textFile()->first();
+
+        if ($textFile === null) {
+            return null;
+        }
+
+        return implode('', iterator_to_array(
+            $this->encryptionService->decryptedChunks($this->storedFilePath($textFile), $key),
+            false,
+        ));
+    }
+
+    /**
+     * The key this session decrypts a share with: the one unlocked with the password and kept in
+     * the session, or the stored one for a share without a password.
+     *
+     * @throws HttpException 403 while a password share is still locked for this session
+     */
+    public function sessionDecryptionKey(Share $share, Session $session): string
+    {
+        if ($share->isPasswordProtected()) {
+            $key = $session->get('share_key_'.$share->token);
+
+            abort_if(! $key, 403, 'Password required');
+
+            return $key;
+        }
+
+        return $this->getDecryptionKey($share);
+    }
+
     /**
      * Generate a unique share token with retry on collision.
      */