surtic86andClaude Opus 5.5
84c8b81f0a
Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11). F1: Uploads that are not complete now count only the bytes the server received, and a chunk that goes above the storage quota gets 422. An anonymous uploader can no longer fill the quota with declared sizes. F2: The share password and the admin login have a second limit without the address (20 attempts per minute per share and per e-mail), because a forged X-Forwarded-For changes the address. F3: The system password gate and the admin check now also run on Livewire updates, so an old uploader snapshot cannot register files. F4: The session keeps a fingerprint of the system password's hash. When the admin changes the system password, earlier verifications end. F5: The page after the upload opens only in the session that created the share, and only while recipients can still reach the share. F6: The share password limit counts an attempt before the password is checked, so parallel attempts cannot pass it. F7: The system password has the same two limits (5 per address, 20 in total per minute). F8: A password change or reset signs the user's other sessions out. F9: The only admin cannot delete the account, which would open /setup to every visitor. The setup wizard also holds the admin password to the password defaults, and Livewire applies EnsureAdmin to updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
72 lines
1.6 KiB
PHP
72 lines
1.6 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Validation\Rules\Password;
|
|
use Livewire\Attributes\Layout;
|
|
use Livewire\Attributes\Validate;
|
|
use Livewire\Component;
|
|
|
|
#[Layout('layouts.app')]
|
|
class SetupWizard extends Component
|
|
{
|
|
#[Validate('required|string|max:255')]
|
|
public string $name = '';
|
|
|
|
#[Validate('required|string|email|max:255|unique:users')]
|
|
public string $email = '';
|
|
|
|
public string $password = '';
|
|
|
|
public string $password_confirmation = '';
|
|
|
|
/**
|
|
* @return array<string, array<int, mixed>>
|
|
*/
|
|
protected function rules(): array
|
|
{
|
|
return [
|
|
'password' => ['required', 'string', Password::defaults(), 'confirmed'],
|
|
];
|
|
}
|
|
|
|
public function mount(): void
|
|
{
|
|
if (User::query()->where('is_admin', true)->exists()) {
|
|
$this->redirect(route('upload'), navigate: true);
|
|
}
|
|
}
|
|
|
|
public function createAdmin(): void
|
|
{
|
|
if (User::query()->where('is_admin', true)->exists()) {
|
|
$this->redirect(route('upload'), navigate: true);
|
|
|
|
return;
|
|
}
|
|
|
|
$this->validate();
|
|
|
|
$user = User::query()->create([
|
|
'name' => $this->name,
|
|
'email' => $this->email,
|
|
'password' => Hash::make($this->password),
|
|
]);
|
|
|
|
$user->is_admin = true;
|
|
$user->save();
|
|
|
|
Auth::login($user);
|
|
|
|
$this->redirect(route('admin.dashboard'), navigate: true);
|
|
}
|
|
|
|
public function render(): mixed
|
|
{
|
|
return view('livewire.setup-wizard');
|
|
}
|
|
}
|