#271: locked share viewer — no metadata before the password, visible errors, deliberate downloads #272

Merged

Cordy merged 3 commits from feat/viewer271 into main

2026-08-18 19:17:40 +00:00

Cordy commented

2026-08-18 19:15:23 +00:00

Owner

Fixes the three password-protected-share findings (#271):

Metadata leak — ServeHTTP served the full viewer (name + size, via a stat) before the password gate. New renderViewerLocked serves a neutral "Files have been shared with you / Enter the password to see them" card with zero content metadata. After the gate admits the session, the viewer fetches a new session-gated ?meta=1 endpoint to reveal name/size; for folder shares it answers {"dir":true} and the page reloads into the server-rendered listing (the key fragment survives the reload, and the v0.6.41 hash-reattach keeps per-file links keyed).
Silent wrong password — the viewer appended "Wrong password." and then called start(), whose innerHTML re-render wiped it. Reordered: re-render first, error after. 429 shows "Too many attempts".
Auto-download — gate success ran decrypt+save immediately. Every unlock path (password mode, layered fragment+password, plain fragment) now ends in an explicit Download button; run() still shows "Downloaded — check your downloads folder" with Download again.

Locked shares gate first regardless of mode, so v0.6.42's layered key+password shares get: gate → metadata reveal → deliberate download → in-browser decrypt.

Fixes the three password-protected-share findings (#271): 1. **Metadata leak** — `ServeHTTP` served the full viewer (name + size, via a stat) *before* the password gate. New `renderViewerLocked` serves a neutral "Files have been shared with you / Enter the password to see them" card with zero content metadata. After the gate admits the session, the viewer fetches a new **session-gated `?meta=1`** endpoint to reveal name/size; for folder shares it answers `{"dir":true}` and the page reloads into the server-rendered listing (the key fragment survives the reload, and the v0.6.41 hash-reattach keeps per-file links keyed). 2. **Silent wrong password** — the viewer appended "Wrong password." and then called `start()`, whose `innerHTML` re-render wiped it. Reordered: re-render first, error after. 429 shows "Too many attempts". 3. **Auto-download** — gate success ran decrypt+save immediately. Every unlock path (password mode, layered fragment+password, plain fragment) now ends in an explicit **Download** button; `run()` still shows "Downloaded — check your downloads folder" with Download again. Locked shares gate first regardless of mode, so v0.6.42's layered key+password shares get: gate → metadata reveal → deliberate download → in-browser decrypt.

Cordy added 3 commits

2026-08-18 19:15:24 +00:00