5 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
surtic86andClaude Opus 5.5	cf73052e0e	Release 2.4.2 ... Fixes the nine findings of a security audit of 2.4.1. The most important: an anonymous uploader could fill the storage quota without sending data, and a forged X-Forwarded-For header could get around the limits on password attempts. Password attempts now also have a limit per share, per login e-mail and for the system password. Whoever entered the system password enters it once more after the update. Update now: docker compose pull and docker compose up -d. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 15:36:31 +02:00
surtic86andClaude Opus 5.5	84c8b81f0a	Fix the security audit's findings ... Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11). F1: Uploads that are not complete now count only the bytes the server received, and a chunk that goes above the storage quota gets 422. An anonymous uploader can no longer fill the quota with declared sizes. F2: The share password and the admin login have a second limit without the address (20 attempts per minute per share and per e-mail), because a forged X-Forwarded-For changes the address. F3: The system password gate and the admin check now also run on Livewire updates, so an old uploader snapshot cannot register files. F4: The session keeps a fingerprint of the system password's hash. When the admin changes the system password, earlier verifications end. F5: The page after the upload opens only in the session that created the share, and only while recipients can still reach the share. F6: The share password limit counts an attempt before the password is checked, so parallel attempts cannot pass it. F7: The system password has the same two limits (5 per address, 20 in total per minute). F8: A password change or reset signs the user's other sessions out. F9: The only admin cannot delete the account, which would open /setup to every visitor. The setup wizard also holds the admin password to the password defaults, and Livewire applies EnsureAdmin to updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 14:46:38 +02:00
surtic86andClaude Opus 5.5	014184c824	Build Docker images only for releases ... A push to main built and pushed the full multi-arch image as :main and sha-<commit>, next to the release build of the same commit. The docker workflow now runs only for v*.*.* tags (and builds without pushing for pull requests), and a release publishes only its version tags and latest. The tests and lint workflows still run on each push to main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 09:18:56 +02:00
surtic86andClaude Opus 5.5	25250b7df3	Release 2.4.1 ... The Docker image runs PHP 8.5.12, which fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619): two flaws that let an attacker without an account run code on the server when a request ends abnormally. Every earlier image runs an affected PHP. Dependencies are up to date (Laravel 13.38, Livewire 4.4.8, Octane 2.22, Vite 8.3.5). Update now: docker compose pull and docker compose up -d. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 08:16:39 +02:00
surtic86andClaude Opus 5.5	307e57b23c	Update dependencies ... Composer: Laravel 13.38, Octane 2.22, Livewire 4.4.8 and Pest 5.3.3, with the packages they bring (35 in all). npm: Vite 8.3.5 with Rolldown 1.2.15, and Playwright 1.64.1. chokidar stays on 5: a major update does not go into a patch release. Both audits are clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 08:16:19 +02:00