surtic86andClaude Opus 5.5
84c8b81f0a
Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11). F1: Uploads that are not complete now count only the bytes the server received, and a chunk that goes above the storage quota gets 422. An anonymous uploader can no longer fill the quota with declared sizes. F2: The share password and the admin login have a second limit without the address (20 attempts per minute per share and per e-mail), because a forged X-Forwarded-For changes the address. F3: The system password gate and the admin check now also run on Livewire updates, so an old uploader snapshot cannot register files. F4: The session keeps a fingerprint of the system password's hash. When the admin changes the system password, earlier verifications end. F5: The page after the upload opens only in the session that created the share, and only while recipients can still reach the share. F6: The share password limit counts an attempt before the password is checked, so parallel attempts cannot pass it. F7: The system password has the same two limits (5 per address, 20 in total per minute). F8: A password change or reset signs the user's other sessions out. F9: The only admin cannot delete the account, which would open /setup to every visitor. The setup wizard also holds the admin password to the password defaults, and Livewire applies EnsureAdmin to updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
114 lines
3.2 KiB
PHP
114 lines
3.2 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Livewire\Livewire;
|
|
|
|
test('profile page is displayed', function () {
|
|
$this->actingAs($user = User::factory()->create());
|
|
|
|
$this->get(route('profile.edit'))->assertOk();
|
|
});
|
|
|
|
test('profile information can be updated', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
$response = Livewire::test('pages::settings.profile')
|
|
->set('name', 'Test User')
|
|
->set('email', 'test@example.com')
|
|
->call('updateProfileInformation');
|
|
|
|
$response->assertHasNoErrors()
|
|
->assertDispatched('profile-updated')
|
|
->assertDispatched('toast', type: 'success', title: 'Saved.');
|
|
|
|
$user->refresh();
|
|
|
|
expect($user->name)->toEqual('Test User');
|
|
expect($user->email)->toEqual('test@example.com');
|
|
});
|
|
|
|
test('the profile saves with its own unchanged email address', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
$response = Livewire::test('pages::settings.profile')
|
|
->set('name', 'Test User')
|
|
->set('email', $user->email)
|
|
->call('updateProfileInformation');
|
|
|
|
$response->assertHasNoErrors();
|
|
|
|
expect($user->refresh()->name)->toEqual('Test User');
|
|
});
|
|
|
|
test('user can delete their account', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
$response = Livewire::test('pages::settings.delete-user-form')
|
|
->set('password', 'password')
|
|
->call('deleteUser');
|
|
|
|
$response
|
|
->assertHasNoErrors()
|
|
->assertRedirect('/');
|
|
|
|
expect($user->fresh())->toBeNull();
|
|
expect(auth()->check())->toBeFalse();
|
|
});
|
|
|
|
test('correct password must be provided to delete account', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
$response = Livewire::test('pages::settings.delete-user-form')
|
|
->set('password', 'wrong-password')
|
|
->call('deleteUser');
|
|
|
|
$response->assertHasErrors(['password']);
|
|
|
|
expect($user->fresh())->not->toBeNull();
|
|
});
|
|
|
|
test('the only admin cannot delete their account', function () {
|
|
$admin = User::query()->where('is_admin', true)->sole();
|
|
|
|
$this->actingAs($admin);
|
|
|
|
Livewire::test('pages::settings.delete-user-form')
|
|
->set('password', 'password')
|
|
->call('deleteUser')
|
|
->assertHasErrors(['password'])
|
|
->assertNoRedirect();
|
|
|
|
expect($admin->fresh())->not->toBeNull();
|
|
expect(auth()->check())->toBeTrue();
|
|
});
|
|
|
|
test('an admin can delete their account while another admin remains', function () {
|
|
$admin = User::factory()->admin()->create();
|
|
|
|
$this->actingAs($admin);
|
|
|
|
Livewire::test('pages::settings.delete-user-form')
|
|
->set('password', 'password')
|
|
->call('deleteUser')
|
|
->assertHasNoErrors()
|
|
->assertRedirect('/');
|
|
|
|
expect($admin->fresh())->toBeNull();
|
|
});
|
|
|
|
test('the only admin\'s account card explains why it cannot be deleted instead of offering the button', function () {
|
|
$this->actingAs(User::query()->where('is_admin', true)->sole());
|
|
|
|
Livewire::test('pages::settings.delete-user-form')
|
|
->assertSee('You are the only admin, so this account cannot be deleted.')
|
|
->assertDontSee('data-test="delete-user-button"', false);
|
|
});
|