Andreas Reinhold / reiniandClaude Opus 5.5
6578335568
ShareDownload::$authenticated was a public property without #[Locked], so a visitor with a share's link but not its password could set it from the browser and see the file list: names, folder paths, sizes and whether the share holds a text. The contents stayed protected; the flag is now locked, and a test tries to set it. Sessions hold the keys of the password shares a recipient unlocked, and were stored unencrypted in the sessions table wherever SESSION_ENCRYPT was not set, which includes every Docker install. They are now encrypted unless SESSION_ENCRYPT=false. Share keys never live in the session, so every share stays readable; people sign in again once. The container generated an APP_KEY when none was set, printed it to the logs and generated another on the next start, which left the shares without a password unreadable. It now refuses to start without one and says how to create it; docker-compose.example.yml requires it for both services. The command it names, and the README's, now pass --entrypoint php: the image's entrypoint ignores its arguments, so "docker run <image> php artisan key:generate --show" never ran it. Every proxy is trusted, so the password-reset mail built its link from a host a forged X-Forwarded-Host could choose. It is now built from APP_URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
108 lines
4.1 KiB
PHP
108 lines
4.1 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire;
|
|
|
|
use App\Models\Share;
|
|
use App\Services\ShareService;
|
|
use Carbon\CarbonInterval;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Livewire\Attributes\Layout;
|
|
use Livewire\Attributes\Locked;
|
|
use Livewire\Attributes\Renderless;
|
|
use Livewire\Attributes\Validate;
|
|
use Livewire\Component;
|
|
|
|
#[Layout('layouts.app')]
|
|
class ShareDownload extends Component
|
|
{
|
|
public Share $share;
|
|
|
|
/** Set only by mount() and verifyPassword(): the browser must never unlock the file list. */
|
|
#[Locked]
|
|
public bool $authenticated = false;
|
|
|
|
#[Validate('required|string')]
|
|
public string $password = '';
|
|
|
|
public function mount(Share $share, ShareService $shareService): void
|
|
{
|
|
$this->share = $share->load('files');
|
|
|
|
// A share at its download limit stays open for the recipient who took its last download.
|
|
if (! $share->isCompleted() || $share->isExpired()
|
|
|| ($share->hasReachedDownloadLimit() && $shareService->downloadWindowEndsAt($share, session()->driver()) === null)) {
|
|
abort(404);
|
|
}
|
|
|
|
$this->authenticated = ! $share->isPasswordProtected() || (bool) session('share_key_'.$share->token);
|
|
}
|
|
|
|
public function verifyPassword(ShareService $shareService): void
|
|
{
|
|
$rateLimitKey = 'share-password:'.$this->share->token.'|'.request()->ip();
|
|
|
|
if (RateLimiter::tooManyAttempts($rateLimitKey, 5)) {
|
|
$seconds = RateLimiter::availableIn($rateLimitKey);
|
|
$this->addError('password', __('Too many attempts. Please try again in :seconds seconds.', ['seconds' => $seconds]));
|
|
|
|
return;
|
|
}
|
|
|
|
$this->validate();
|
|
|
|
if (! $shareService->verifyPassword($this->share, $this->password)) {
|
|
RateLimiter::hit($rateLimitKey, 60);
|
|
$this->addError('password', __('The password is incorrect.'));
|
|
|
|
return;
|
|
}
|
|
|
|
RateLimiter::clear($rateLimitKey);
|
|
|
|
$encryptionKey = $shareService->getDecryptionKey($this->share, $this->password);
|
|
session(['share_key_'.$this->share->token => $encryptionKey]);
|
|
$this->authenticated = true;
|
|
}
|
|
|
|
/**
|
|
* The share's private text, for the recipient who pressed "Show text": counted as their
|
|
* download, as a file would be. Returned to the browser only, never kept in a property, so it
|
|
* is not in the component's snapshot. Null when the text is no longer available; no abort(),
|
|
* which would open Livewire's error modal. Renderless: a re-render would morph the download
|
|
* note Alpine just switched back into the one it hid.
|
|
*/
|
|
#[Renderless]
|
|
public function revealText(ShareService $shareService): ?string
|
|
{
|
|
$share = $this->share;
|
|
|
|
if (! $share->isCompleted() || $share->isExpired() || ! $share->hasText()
|
|
|| ($share->isPasswordProtected() && ! session('share_key_'.$share->token))
|
|
|| ! $shareService->claimDownload($share, session()->driver())) {
|
|
return null;
|
|
}
|
|
|
|
return $shareService->readText($share, $shareService->sessionDecryptionKey($share, session()->driver()));
|
|
}
|
|
|
|
public function render(): mixed
|
|
{
|
|
$shareService = app(ShareService::class);
|
|
$files = $this->share->files->where('is_text', false)->values();
|
|
|
|
return view('livewire.share-download', [
|
|
'files' => $files,
|
|
'downloads' => $files->map(fn ($file): array => [
|
|
'id' => $file->id,
|
|
'path' => $file->relative_path ?: $file->original_name,
|
|
'size' => $file->file_size,
|
|
'url' => route('share.download.file', [$this->share, $file]),
|
|
]),
|
|
'hasText' => $this->share->files->contains('is_text', true),
|
|
'downloadWindowEndsAt' => $shareService->downloadWindowEndsAt($this->share, session()->driver()),
|
|
'remainingDownloads' => $this->share->max_downloads ? max($this->share->max_downloads - $this->share->download_count, 0) : null,
|
|
'downloadWindow' => CarbonInterval::minutes(ShareService::DOWNLOAD_WINDOW_MINUTES)->cascade()->forHumans(),
|
|
]);
|
|
}
|
|
}
|