surtic86andClaude Opus 5.5
84c8b81f0a
Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11). F1: Uploads that are not complete now count only the bytes the server received, and a chunk that goes above the storage quota gets 422. An anonymous uploader can no longer fill the quota with declared sizes. F2: The share password and the admin login have a second limit without the address (20 attempts per minute per share and per e-mail), because a forged X-Forwarded-For changes the address. F3: The system password gate and the admin check now also run on Livewire updates, so an old uploader snapshot cannot register files. F4: The session keeps a fingerprint of the system password's hash. When the admin changes the system password, earlier verifications end. F5: The page after the upload opens only in the session that created the share, and only while recipients can still reach the share. F6: The share password limit counts an attempt before the password is checked, so parallel attempts cannot pass it. F7: The system password has the same two limits (5 per address, 20 in total per minute). F8: A password change or reset signs the user's other sessions out. F9: The only admin cannot delete the account, which would open /setup to every visitor. The setup wizard also holds the admin password to the password defaults, and Livewire applies EnsureAdmin to updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
80 lines
4.0 KiB
PHP
80 lines
4.0 KiB
PHP
<?php
|
|
|
|
use App\Models\Setting;
|
|
use App\Models\Share;
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Storage;
|
|
use Illuminate\Testing\TestResponse;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* The opening tag of the page template's pane (resources/views/components/page.blade.php).
|
|
*/
|
|
function pageTag(string $html): string
|
|
{
|
|
preg_match('/<div\s[^>]*data-test="page"[^>]*>/', $html, $matches);
|
|
|
|
return $matches[0] ?? '';
|
|
}
|
|
|
|
test('every page is one page template, one h1 and the same width', function (Closure $visit) {
|
|
$html = $visit($this)->assertOk()->getContent();
|
|
|
|
expect(substr_count($html, 'data-test="page"'))->toBe(1)
|
|
->and(preg_match_all('/<h1[\s>]/', $html))->toBe(1)
|
|
->and(pageTag($html))->toContain('data-md-width="narrow"');
|
|
})->with([
|
|
'upload' => [fn (TestCase $test): TestResponse => $test->get(route('upload'))],
|
|
'download' => [fn (TestCase $test): TestResponse => $test->get(route('share.download', Share::factory()->withPassword()->create()))],
|
|
'share created' => [function (TestCase $test): TestResponse {
|
|
$share = Share::factory()->create();
|
|
|
|
return $test->withSession(['created_shares' => [$share->token]])->get(route('share.created', $share));
|
|
}],
|
|
'login' => [fn (TestCase $test): TestResponse => $test->get(route('login'))],
|
|
'forgot password' => [fn (TestCase $test): TestResponse => $test->get(route('password.request'))],
|
|
'reset password' => [fn (TestCase $test): TestResponse => $test->get(route('password.reset', 'token'))],
|
|
'two-factor challenge' => [fn (TestCase $test): TestResponse => $test->withSession(['login.id' => User::factory()->withTwoFactor()->create()->id])->get(route('two-factor.login'))],
|
|
'setup' => [function (TestCase $test): TestResponse {
|
|
User::query()->where('is_admin', true)->delete();
|
|
|
|
return $test->get(route('setup'));
|
|
}],
|
|
'system password' => [function (TestCase $test): TestResponse {
|
|
Setting::set('system_password', bcrypt('system-secret'));
|
|
|
|
return $test->get(route('system-password'));
|
|
}],
|
|
'confirm password' => [fn (TestCase $test): TestResponse => $test->actingAs(User::factory()->create())->get(route('password.confirm'))],
|
|
'profile' => [fn (TestCase $test): TestResponse => $test->actingAs(User::factory()->create())->get(route('profile.edit'))],
|
|
'password' => [fn (TestCase $test): TestResponse => $test->actingAs(User::factory()->create())->get(route('user-password.edit'))],
|
|
'two-factor settings' => [fn (TestCase $test): TestResponse => $test->actingAs(User::factory()->create())->withSession(['auth.password_confirmed_at' => time()])->get(route('two-factor.show'))],
|
|
'appearance' => [fn (TestCase $test): TestResponse => $test->actingAs(User::factory()->create())->get(route('appearance.edit'))],
|
|
'admin settings' => [fn (TestCase $test): TestResponse => $test->actingAs(User::factory()->admin()->create())->get(route('admin.settings'))],
|
|
'admin dashboard' => [fn (TestCase $test): TestResponse => $test->actingAs(User::factory()->admin()->create())->get(route('admin.dashboard'))],
|
|
]);
|
|
|
|
test("a brand page is headed by the site's own logo, title and description", function () {
|
|
Setting::set('site_title', 'Acme Files');
|
|
Setting::set('site_description', 'Send files to Acme Engineering.');
|
|
Setting::set('site_logo', 'branding/acme.png');
|
|
|
|
$html = $this->get(route('login'))
|
|
->assertOk()
|
|
->assertSeeInOrder(['data-test="page-logo"', '<h1', 'Send files to Acme Engineering.'], false)
|
|
->assertSee(Storage::disk('public')->url('branding/acme.png'), false)
|
|
->getContent();
|
|
|
|
expect($html)->toMatch('/<h1[^>]*>\s*Acme Files\s*<\/h1>/');
|
|
});
|
|
|
|
test('a brand page falls back to the app name and SealShare\'s own line without branding', function () {
|
|
$html = $this->get(route('upload'))
|
|
->assertOk()
|
|
->assertSeeInOrder(['<h1', 'Share your files safely and securely'], false)
|
|
->assertDontSee('data-test="page-logo"', false)
|
|
->getContent();
|
|
|
|
expect($html)->toMatch('/<h1[^>]*>\s*'.preg_quote(config('app.name'), '/').'\s*<\/h1>/');
|
|
});
|