surtic86andClaude Opus 5.5
84c8b81f0a
Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11). F1: Uploads that are not complete now count only the bytes the server received, and a chunk that goes above the storage quota gets 422. An anonymous uploader can no longer fill the quota with declared sizes. F2: The share password and the admin login have a second limit without the address (20 attempts per minute per share and per e-mail), because a forged X-Forwarded-For changes the address. F3: The system password gate and the admin check now also run on Livewire updates, so an old uploader snapshot cannot register files. F4: The session keeps a fingerprint of the system password's hash. When the admin changes the system password, earlier verifications end. F5: The page after the upload opens only in the session that created the share, and only while recipients can still reach the share. F6: The share password limit counts an attempt before the password is checked, so parallel attempts cannot pass it. F7: The system password has the same two limits (5 per address, 20 in total per minute). F8: A password change or reset signs the user's other sessions out. F9: The only admin cannot delete the account, which would open /setup to every visitor. The setup wizard also holds the admin password to the password defaults, and Livewire applies EnsureAdmin to updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
73 lines
2.4 KiB
PHP
73 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Actions\Fortify\ResetUserPassword;
|
|
use App\Models\User;
|
|
use Illuminate\Auth\Notifications\ResetPassword;
|
|
use Illuminate\Cache\RateLimiting\Limit;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\ServiceProvider;
|
|
use Illuminate\Support\Str;
|
|
use Laravel\Fortify\Fortify;
|
|
|
|
class FortifyServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
$this->configureActions();
|
|
$this->configureViews();
|
|
$this->configureRateLimiting();
|
|
}
|
|
|
|
/**
|
|
* Configure Fortify actions.
|
|
*/
|
|
private function configureActions(): void
|
|
{
|
|
Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
|
|
|
|
// From APP_URL, never the request's host: every proxy is trusted, so a forged X-Forwarded-Host would otherwise pick it.
|
|
ResetPassword::createUrlUsing(fn (User $user, string $token): string => rtrim((string) config('app.url'), '/').route('password.reset', [
|
|
'token' => $token,
|
|
'email' => $user->getEmailForPasswordReset(),
|
|
], false));
|
|
}
|
|
|
|
/**
|
|
* Configure Fortify views.
|
|
*/
|
|
private function configureViews(): void
|
|
{
|
|
Fortify::loginView(fn () => view('pages::auth.login'));
|
|
Fortify::twoFactorChallengeView(fn () => view('pages::auth.two-factor-challenge'));
|
|
Fortify::confirmPasswordView(fn () => view('pages::auth.confirm-password'));
|
|
Fortify::resetPasswordView(fn () => view('pages::auth.reset-password'));
|
|
Fortify::requestPasswordResetLinkView(fn () => view('pages::auth.forgot-password'));
|
|
}
|
|
|
|
/**
|
|
* Configure rate limiting.
|
|
*/
|
|
private function configureRateLimiting(): void
|
|
{
|
|
RateLimiter::for('two-factor', function (Request $request) {
|
|
return Limit::perMinute(5)->by($request->session()->get('login.id'));
|
|
});
|
|
|
|
RateLimiter::for('login', function (Request $request) {
|
|
$throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
|
|
|
|
// The address comes from X-Forwarded-For behind the proxy, so a second limit per e-mail does not use it.
|
|
return [
|
|
Limit::perMinute(5)->by($throttleKey),
|
|
Limit::perMinute(20)->by(Str::transliterate(Str::lower($request->input(Fortify::username())))),
|
|
];
|
|
});
|
|
}
|
|
}
|