Andreas Reinhold / reiniandClaude Opus 5.5
6578335568
ShareDownload::$authenticated was a public property without #[Locked], so a visitor with a share's link but not its password could set it from the browser and see the file list: names, folder paths, sizes and whether the share holds a text. The contents stayed protected; the flag is now locked, and a test tries to set it. Sessions hold the keys of the password shares a recipient unlocked, and were stored unencrypted in the sessions table wherever SESSION_ENCRYPT was not set, which includes every Docker install. They are now encrypted unless SESSION_ENCRYPT=false. Share keys never live in the session, so every share stays readable; people sign in again once. The container generated an APP_KEY when none was set, printed it to the logs and generated another on the next start, which left the shares without a password unreadable. It now refuses to start without one and says how to create it; docker-compose.example.yml requires it for both services. The command it names, and the README's, now pass --entrypoint php: the image's entrypoint ignores its arguments, so "docker run <image> php artisan key:generate --show" never ran it. Every proxy is trusted, so the password-reset mail built its link from a host a forged X-Forwarded-Host could choose. It is now built from APP_URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
2.7 KiB
PHP
86 lines
2.7 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Auth\Notifications\ResetPassword;
|
|
use Illuminate\Support\Facades\Notification;
|
|
|
|
test('reset password link screen can be rendered', function () {
|
|
$response = $this->get(route('password.request'));
|
|
|
|
$response->assertOk();
|
|
});
|
|
|
|
test('reset password link can be requested', function () {
|
|
Notification::fake();
|
|
|
|
$user = User::factory()->create();
|
|
|
|
$this->post(route('password.request'), ['email' => $user->email]);
|
|
|
|
Notification::assertSentTo($user, ResetPassword::class);
|
|
});
|
|
|
|
test('the reset link points at APP_URL, whatever host the request claims', function () {
|
|
Notification::fake();
|
|
config(['app.url' => 'https://share.example.com']);
|
|
|
|
$user = User::factory()->create();
|
|
|
|
$this->withHeader('X-Forwarded-Host', 'attacker.example')
|
|
->post(route('password.request'), ['email' => $user->email]);
|
|
|
|
Notification::assertSentTo($user, ResetPassword::class, function (ResetPassword $notification) use ($user) {
|
|
return str_starts_with($notification->toMail($user)->actionUrl, 'https://share.example.com/reset-password/');
|
|
});
|
|
});
|
|
|
|
test('reset password screen can be rendered', function () {
|
|
Notification::fake();
|
|
|
|
$user = User::factory()->create();
|
|
|
|
$this->post(route('password.request'), ['email' => $user->email]);
|
|
|
|
Notification::assertSentTo($user, ResetPassword::class, function ($notification) {
|
|
$response = $this->get(route('password.reset', $notification->token));
|
|
|
|
$response->assertOk();
|
|
|
|
return true;
|
|
});
|
|
});
|
|
|
|
test('password can be reset with valid token', function () {
|
|
Notification::fake();
|
|
|
|
$user = User::factory()->create();
|
|
|
|
$this->post(route('password.request'), ['email' => $user->email]);
|
|
|
|
Notification::assertSentTo($user, ResetPassword::class, function ($notification) use ($user) {
|
|
$response = $this->post(route('password.update'), [
|
|
'token' => $notification->token,
|
|
'email' => $user->email,
|
|
'password' => 'password',
|
|
'password_confirmation' => 'password',
|
|
]);
|
|
|
|
$response
|
|
->assertSessionHasNoErrors()
|
|
->assertRedirect(route('login', absolute: false));
|
|
|
|
return true;
|
|
});
|
|
});
|
|
|
|
test('reset password mail wears the material theme in the app scheme', function () {
|
|
$user = User::factory()->create();
|
|
$scheme = json_decode(file_get_contents(resource_path('css/material-scheme.json')), true);
|
|
|
|
$html = (string) (new ResetPassword('token'))->toMail($user)->render();
|
|
|
|
expect($html)
|
|
->toContain('background-color: '.$scheme['light']['primary'])
|
|
->toContain(route('password.reset', ['token' => 'token', 'email' => $user->email]));
|
|
});
|