surtic86andClaude Opus 5.5
84c8b81f0a
Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11). F1: Uploads that are not complete now count only the bytes the server received, and a chunk that goes above the storage quota gets 422. An anonymous uploader can no longer fill the quota with declared sizes. F2: The share password and the admin login have a second limit without the address (20 attempts per minute per share and per e-mail), because a forged X-Forwarded-For changes the address. F3: The system password gate and the admin check now also run on Livewire updates, so an old uploader snapshot cannot register files. F4: The session keeps a fingerprint of the system password's hash. When the admin changes the system password, earlier verifications end. F5: The page after the upload opens only in the session that created the share, and only while recipients can still reach the share. F6: The share password limit counts an attempt before the password is checked, so parallel attempts cannot pass it. F7: The system password has the same two limits (5 per address, 20 in total per minute). F8: A password change or reset signs the user's other sessions out. F9: The only admin cannot delete the account, which would open /setup to every visitor. The setup wizard also holds the admin password to the password defaults, and Livewire applies EnsureAdmin to updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
55 lines
1.6 KiB
PHP
55 lines
1.6 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Http\Middleware\EnsureAdmin;
|
|
use App\Http\Middleware\SystemPasswordGate;
|
|
use App\Models\Setting;
|
|
use Carbon\CarbonImmutable;
|
|
use Illuminate\Support\Facades\Date;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\ServiceProvider;
|
|
use Illuminate\Validation\Rules\Password;
|
|
use Livewire\Livewire;
|
|
use NoNameWeb\LivewireMaterial\Support\Scheme;
|
|
|
|
class AppServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
$this->configureDefaults();
|
|
|
|
// The colour profile the admin chose in Admin settings; asked each time a page, mail or
|
|
// error page draws its colours, so a new choice applies at once in every Octane worker.
|
|
Scheme::resolveProfileUsing(fn (): ?string => Setting::get('color_profile'));
|
|
|
|
// Livewire updates apply a page route's middleware only when it is listed as persistent.
|
|
Livewire::addPersistentMiddleware([SystemPasswordGate::class, EnsureAdmin::class]);
|
|
}
|
|
|
|
/**
|
|
* Configure default behaviors for production-ready applications.
|
|
*/
|
|
protected function configureDefaults(): void
|
|
{
|
|
Date::use(CarbonImmutable::class);
|
|
|
|
DB::prohibitDestructiveCommands(
|
|
app()->isProduction(),
|
|
);
|
|
|
|
Password::defaults(fn (): ?Password => app()->isProduction()
|
|
? Password::min(12)
|
|
->mixedCase()
|
|
->letters()
|
|
->numbers()
|
|
->symbols()
|
|
->uncompromised()
|
|
: null
|
|
);
|
|
}
|
|
}
|