Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).
F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.
F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.
F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.
F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.
F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.
F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.
F7: The system password has the same two limits (5 per address, 20 in
total per minute).
F8: A password change or reset signs the user's other sessions out.
F9: The only admin cannot delete the account, which would open /setup
to every visitor.
The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Config: auth, services, logging, queue and database only repeated the
framework's own files and are gone; the others keep only the keys that
differ (app version, cache serializable_classes, session cookie name,
Markdown mail theme, the shares disk, three Octane values, Livewire's
pagination theme and payload guards).
- Email verification is removed: User never implemented MustVerifyEmail,
so it was never enforced, and SealShare has a single admin and no
registration. CreateNewUser goes with it.
- FileEncryptionService::encryptFile() and generateSalt() were only used
by tests; tests build files with encryptTestFile() in tests/Pest.php.
- The expiration options are defined once, as Share::EXPIRATIONS. "30 Days"
now lasts 30 days instead of a calendar month, and Admin settings only
save a default expiration that is one of the options.
- One-caller helpers are inlined, the uploader reads chunk responses with
XHR's responseType, and starter-kit leftovers are removed.
- Docker: PHP reads the PHP_* limits from the environment itself
(${VAR:-default} in uploads.ini); both entrypoints stop writing the ini.
docker-compose.yml shares the app and scheduler variables through one
anchor. The dev image installs gd for the screenshot publisher and fake
test images.
- Development runs in Docker only: the composer dev script, concurrently,
laravel/pail, laravel/sail, autoprefixer and the shell-quote override
are gone.
- phpunit.xml forces the test environment with <server> entries, so tests
run in the dev container no longer use its real database.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The pages were built five ways: two layouts, seven widths from 28 to
64rem and four heading styles. Every page now looks like the share
pages: a centred heading over one 40rem column of outlined cards, with
the floating toolbar below.
- <x-page> (components/page.blade.php) is the root of every page. It
draws the h1 and its line (`brand` takes the site's logo, title and
description from Admin settings), an optional `mark` and `navigation`
slot, then the content. It has no width prop: every page is the same
<x-pane width="narrow">.
- The sign-in, password reset, confirm, verify email, two-factor
challenge, setup and system password pages move onto layouts/app with
the brand heading and their form in a card titled with the task.
layouts/auth, auth-header and the settings heading partial are gone,
and so is the per-page width CSS.
- Settings put their section nav under the heading; the admin pages get
a description line each. FileUploader and ShareDownload no longer pass
the branding to their views.
- The admin dashboard's table needed about 49rem, so its shares are a
list: created above the token, which opens the share, then files,
size, downloads and expiry on two lines that wrap instead of clipping,
and one delete button. A "Sort by" select replaces the column headers
(newest, oldest, expiring soonest with never-expiring last, largest,
most downloads, most files) and resets the page. The stats stay two
by two. table.css and sort-header.css are no longer imported.
- Branding hints in Admin settings name every page the title shows on.
- Tests: PageTemplateTest renders every page once and checks one page
template, one h1 and the width, and the brand heading with its
fallbacks. FrameTest measures the page column instead of the auth
card and the 64rem main; dashboard tests follow the list and the sort
select, including expiry order. .ai/rules/views.md records <x-page>,
the CHANGELOG notes the change and the website screenshots are
regenerated.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
surtic86andClaude Opus 5.5