release(v3.23.0): authentication and authorization hardening

- security(auth): harden TOTP verification and account settings
- security(oidc): bind accounts by immutable provider identity
- security(files): enforce upload, callback, and path boundaries

Author: error311

CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## Changes 07/25/2026 (v3.23.0)
+
+`release(v3.23.0): authentication and authorization hardening`
+
+**Commit message**
+
+```text
+release(v3.23.0): authentication and authorization hardening
+
+- security(auth): harden TOTP verification and account settings
+- security(oidc): bind accounts by immutable provider identity
+- security(files): enforce upload, callback, and path boundaries
+```
+
+**Fixed**
+
+- TOTP verification now enforces persistent account-wide and source-wide attempt budgets across all pending-login verification paths, and the alternate auth handler now resolves the shared TOTP verifier correctly, so changing sessions or client addresses cannot reset the second-factor limit.
+- Successfully accepted TOTP time steps are now claimed atomically per account and authenticator secret, preventing the same still-valid code from completing authentication more than once.
+- Successful TOTP verification clears the account budget without counting ordinary successful logins against shared-network failure limits.
+- TOTP enrollment now remains pending until a valid code confirms the new authenticator, and enrollment, disablement, and recovery-code rotation require a recent full authentication.
+- OIDC logins now bind the validated issuer-and-subject identity to a local account, ignore unverified email for naming, and cannot attach a mutable username claim to an existing local account.
+- Upload and rename validation now rejects trailing-dot filenames across regular, resumable, shared, and WebDAV write paths so filesystem or web-server normalization cannot bypass blocked executable names.
+- Logical folder paths now reject raw or encoded `.` and `..` segments before ACL evaluation or storage access; local writes use boundary-aware containment before directory creation, and WebDAV operations cannot escape the configured source root.
+- ZIP, 7z, and RAR extraction now occurs in a private temporary workspace on the same local storage volume, and validated regular files are placed atomically only through real in-root destination directories; pre-existing destination symlinks can no longer redirect extraction or cleanup outside the storage root.
+- ONLYOFFICE save callbacks now require a valid HS256 JWT from the configured Document Server; omitting the callback JWT no longer falls back to trusting the unsigned request body.
+- Cross-parent folder renames now enforce destination move rights and matching ownership boundaries, preventing a folder owner from moving their tree into another user's folder or the admin-controlled root.
+
+**Upgrade notes**
+
+- **Breaking security change for existing OIDC deployments:** OIDC identities created before v3.23.0 do not have an issuer/subject binding and cannot continue matching an existing local account automatically.
+- **ONLYOFFICE callback security change:** Before upgrading, ensure the Document Server has outgoing/outbox JWTs enabled and uses the same secret configured in FileRise. Correctly configured deployments require no data migration.
+- Older or misconfigured Document Servers that omit callback JWTs will be unable to save until their outgoing JWT configuration is corrected. `ONLYOFFICE_ALLOW_UNSIGNED_CALLBACKS=1` is available only as a temporary, explicitly unsafe recovery measure; remove it immediately after confirming a signed document save.
+- After five failed TOTP submissions, that account waits up to 15 minutes before another verification attempt.
+- Sessions whose full authentication is more than five minutes old must sign in again before changing TOTP security settings; remember-me restoration alone does not satisfy this check.
+- Existing non-OIDC users, TOTP secrets, sessions, Docker volumes, and deployment configuration require no migration.
+- Before upgrading an OIDC deployment, verify a working local administrator login and back up the `users` directory.
+- On the first OIDC login for an existing account, FileRise presents a one-time guided link prompt for that account's local password and, when configured, TOTP. This confirmation works even when ordinary form login is disabled.
+- New OIDC identities whose proposed username does not collide with an existing local account continue to auto-provision normally when OIDC auto-provisioning is enabled; they are bound to the validated issuer and subject immediately and do not receive the guided link prompt.
+- OIDC-only users without a known local password require an administrator-assisted password reset or account migration. Complete this preparation before upgrading any deployment whose only administrator uses OIDC.
+- See `docs/wiki/oidc sso.md` under **Upgrading existing OIDC accounts to v3.23.0** for the complete migration procedure.
+
+---
+
 ## Changes 07/13/2026 (v3.22.0)
 
 `release(v3.22.0): generate unique keys for pristine manual installs`

config/config.php

@@ -40,7 +40,7 @@
 define('TIMEZONE',      'America/New_York');
 define('DATE_TIME_FORMAT','m/d/y  h:iA');
 define('TOTAL_UPLOAD_SIZE', '5G');
-define('REGEX_FOLDER_NAME','/^(?!^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])$)(?!.*[. ]$)(?:[^<>:"\/\\\\|?*\x00-\x1F]{1,255})(?:[\/\\\\][^<>:"\/\\\\|?*\x00-\x1F]{1,255})*$/xu');
+define('REGEX_FOLDER_NAME','/^(?!^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])$)(?!\.{1,2}(?:[\/\\\\]|$))(?!.*[\/\\\\]\.{1,2}(?:[\/\\\\]|$))(?!.*[. ]$)(?:[^<>:"\/\\\\|?*\x00-\x1F]{1,255})(?:[\/\\\\][^<>:"\/\\\\|?*\x00-\x1F]{1,255})*$/xu');
 define('PATTERN_FOLDER_NAME','[\p{L}\p{N}_\-\s\/\\\\]+');
 define('REGEX_FILE_NAME', '/^[^\x00-\x1F\/\\\\]{1,255}$/u');
 define('REGEX_USER',       '/^(?!\.{1,2}$)[\p{L}\p{N}_\- .@]+$/u');
@@ -62,6 +62,8 @@
 define('ONLYOFFICE_JWT_SECRET', 'test123456');
 define('ONLYOFFICE_DOCS_ORIGIN', 'http://192.168.1.61'); // your Document Server
 define('ONLYOFFICE_DEBUG', true);
+// Emergency migration only; leaves callback bodies unauthenticated.
+// define('ONLYOFFICE_ALLOW_UNSIGNED_CALLBACKS', false);
 */
 if (!defined('OFFICE_SNIPPET_MAX_BYTES')) {
     define('OFFICE_SNIPPET_MAX_BYTES', 5 * 1024 * 1024); // 5 MiB
@@ -456,6 +458,7 @@ function fr_forget_authenticated_user(bool $clearRememberCookie = false): void
         $_SESSION['folderOnly'],
         $_SESSION['readOnly'],
         $_SESSION['disableUpload'],
+        $_SESSION['authenticated_at'],
         $_SESSION['pending_login_user'],
         $_SESSION['pending_login_secret'],
         $_SESSION['pending_login_remember_me']
@@ -528,6 +531,7 @@ function fr_forget_authenticated_user(bool $clearRememberCookie = false): void
         }
 
         $_SESSION["authenticated"] = true;
+        unset($_SESSION['authenticated_at']);
         $_SESSION["username"]      = $payload["username"];
         $perms = loadUserPermissions($payload["username"]);
         $_SESSION["folderOnly"]    = $perms['folderOnly']    ?? false;
@@ -591,6 +595,7 @@ function fr_forget_authenticated_user(bool $clearRememberCookie = false): void
 
             $username = $_SERVER[$hdrKey];
             $_SESSION['authenticated'] = true;
+            $_SESSION['authenticated_at'] = time();
             $_SESSION['username']      = $username;
 
             // ◾ lookup actual role instead of forcing admin

docs/wiki/oidc sso.md

@@ -37,6 +37,69 @@ Advanced override (in `config/config.php` or env):
 
 - `FR_OIDC_AUTO_CREATE` (`true`/`false`)
 
+FileRise binds each OIDC account using the provider's immutable issuer and subject
+identifiers. `preferred_username` is used only to name a new local account.
+Verified email can be used when no valid preferred username is available.
+Neither claim can attach an unbound OIDC identity to an existing local account.
+
+Bindings are stored in `users/oidc_identities.json`; include this file in backups
+with the rest of the users directory.
+
+### Upgrading existing OIDC accounts to v3.23.0
+
+> **Breaking security change:** OIDC accounts used before v3.23.0 do not yet
+> have an issuer/subject binding. Their first OIDC login after upgrading cannot
+> automatically match the existing local account.
+
+This affects only upgrades of deployments with existing OIDC users. It does not
+change local-password accounts, stored files, permissions, TOTP secrets, Docker
+volumes, or the OIDC provider configuration.
+
+#### Before upgrading
+
+1. Back up the complete FileRise `users` directory.
+2. Open a private browser window and confirm that at least one administrator can
+   sign in with a local username and password.
+3. Identify accounts that use OIDC exclusively and do not have a known local
+   password.
+4. While an administrator is still signed in, assign those users temporary
+   local passwords or plan an administrator-assisted account migration.
+5. If the only administrator uses OIDC, set and test a local administrator
+   password before upgrading. Do not rely on an existing browser session as the
+   only recovery method.
+
+#### Link each existing account after upgrading
+
+1. Start the normal FileRise OIDC login.
+2. Authenticate as the corresponding user at the configured identity provider.
+3. When FileRise detects the existing unbound local account, it displays a
+   one-time account-link confirmation with the local username fixed and
+   read-only.
+4. Enter that account's local password. If the account has TOTP enabled,
+   complete the existing TOTP prompt as well.
+5. FileRise records the immutable issuer/subject binding in
+   `users/oidc_identities.json`.
+6. Sign out and verify that a new OIDC login returns to the same FileRise
+   account with its existing role and permissions.
+
+The guided confirmation is available only after a validated OIDC callback,
+expires after five minutes, and works even when ordinary form login is disabled.
+Canceling it clears the pending session without modifying the local account.
+
+Repeat the procedure for each existing OIDC account and include
+`users/oidc_identities.json` in future backups. Retire any temporary passwords
+according to your local credential policy after verifying the bindings.
+
+If a user attempts OIDC login before completing the link, FileRise rejects a
+claim that collides with the existing local username. The rejection does not
+delete or modify the existing account.
+
+OIDC-only users without a known local password require an administrator-assisted
+password reset or migration to a newly auto-provisioned OIDC account. FileRise
+deliberately does not perform automatic first-login matching because a mutable
+claim cannot prove ownership of an existing account and would recreate the
+account-takeover vulnerability.
+
 ---
 
 ## Admin group mapping

docs/wiki/onlyoffice.md

@@ -16,7 +16,71 @@ Supported:
    - Document Server origin (e.g. `https://docs.example.com`)
    - JWT secret (shared with your Document Server)
    - Optional: Public origin (if callbacks must use a different public URL)
-3. Use **Run tests** in the admin panel to validate connectivity.
+3. Ensure outgoing/outbox JWTs are enabled on the Document Server.
+4. Use **Run tests** in the admin panel to validate connectivity and confirm callback JWT enforcement is active.
+5. Open, edit, and save a test document to verify the Document Server can complete a signed callback.
+
+For a Docker Document Server, configure a stable secret when creating the container:
+
+```yaml
+environment:
+  JWT_ENABLED: "true"
+  JWT_SECRET: "replace-with-the-same-secret-used-by-filerise"
+```
+
+For a package installation or an older Document Server, ensure all three values are configured in `/etc/onlyoffice/documentserver/local.json` and restart the ONLYOFFICE services:
+
+```json
+{
+  "services": {
+    "CoAuthoring": {
+      "token": {
+        "enable": {
+          "request": {
+            "outbox": true
+          }
+        }
+      },
+      "secret": {
+        "outbox": {
+          "string": "replace-with-the-same-secret-used-by-filerise"
+        }
+      }
+    }
+  }
+}
+```
+
+Do not edit `default.json`; ONLYOFFICE can replace that file during upgrades.
+
+---
+
+## Upgrading to FileRise v3.23.0
+
+FileRise v3.23.0 rejects missing and invalid callback JWTs. Previous FileRise versions accepted an unsigned callback body when the separate FileRise callback URL token was valid.
+
+Before upgrading:
+
+1. Confirm the JWT secret configured in FileRise matches the Document Server's `JWT_SECRET` or outbox secret.
+2. Confirm outgoing/outbox request tokens are enabled.
+3. Restart the Document Server after changing its JWT configuration.
+4. After upgrading FileRise, use **Run tests**, then edit and save a test document.
+
+Existing documents, accounts, and FileRise storage require no migration. A correctly configured Document Server continues working normally.
+
+If saves fail because an older deployment is not sending callback JWTs, correct the Document Server configuration first. As a temporary recovery measure only, set this environment variable on the FileRise container or PHP service:
+
+```text
+ONLYOFFICE_ALLOW_UNSIGNED_CALLBACKS=1
+```
+
+For a manual FileRise installation, the equivalent temporary override is:
+
+```php
+define('ONLYOFFICE_ALLOW_UNSIGNED_CALLBACKS', true);
+```
+
+This override restores the old unsigned-body behavior and weakens callback authentication. Keep it enabled only long enough to correct the Document Server, restart it, and confirm a successful signed save. Then remove the override and restart FileRise. The Admin Panel displays a security warning while the override is active.
 
 ---
 
@@ -63,3 +127,5 @@ You can lock ONLYOFFICE settings in `config/config.php` by defining:
 - `ONLYOFFICE_PUBLIC_ORIGIN`
 
 When any of these are defined, the admin UI reflects the locked values.
+
+`ONLYOFFICE_ALLOW_UNSIGNED_CALLBACKS` is an emergency compatibility override, not a normal integration setting. It defaults to `false` and should not remain enabled.

public/api/folder/renameFolder.php

@@ -5,7 +5,7 @@
  * @OA\Post(
  *   path="/api/folder/renameFolder.php",
  *   summary="Rename or move a folder",
- *   description="Requires authentication, CSRF token, scope checks on old and new paths, and (for non-admins) ownership of the source folder.",
+ *   description="Requires authentication, CSRF, source ownership, and destination move authorization when the parent changes.",
  *   operationId="renameFolder",
  *   tags={"Folders"},
  *   security={{"cookieAuth": {}}},
@@ -29,4 +29,4 @@
 require_once __DIR__ . '/../../../config/config.php';
 
 $folderController = new \FileRise\Http\Controllers\FolderController();
-$folderController->renameFolder();
+$folderController->renameFolder();

public/js/adminOnlyOffice.js

@@ -212,7 +212,9 @@ function attachOnlyOfficeTests(container) {
       </div>
       <ul id="ooTestResults" class="list-unstyled" style="margin:0;"></ul>
       <small class="text-muted">
-        These tests check FileRise config, callback reachability, CSP/script loading, and iframe embedding.
+        These tests check FileRise config, callback enforcement, reachability, CSP/script loading,
+        and iframe embedding. Complete one real document save after an upgrade to confirm the
+        Document Server sends a valid outgoing callback JWT.
       </small>
     </div>
   `;
@@ -257,8 +259,18 @@ function attachOnlyOfficeTests(container) {
       } else {
         out.appendChild(ooRow('FileRise status', 'fail', `HTTP ${r.status}`));
       }
+      out.appendChild(
+        ooRow(
+          'Callback JWT enforcement',
+          statusJson.callbackJwtRequired ? 'ok' : 'warn',
+          statusJson.callbackJwtRequired
+            ? 'Required — unsigned callbacks are rejected'
+            : 'UNSAFE compatibility override enabled'
+        )
+      );
     } catch (e) {
       out.appendChild(ooRow('FileRise status', 'fail', (e && e.message) || 'Network error'));
+      out.appendChild(ooRow('Callback JWT enforcement', 'warn', 'Could not verify'));
     }
 
     // 2) Secret presence (fresh read)
@@ -487,6 +499,15 @@ export function initOnlyOfficeUI({ config }) {
   // Initial values
   const enabled = !!onlyCfg.enabled;
   const docsOrigin = onlyCfg.docsOrigin || '';
+  const unsignedCallbacksAllowed = !!onlyCfg.unsignedCallbacksAllowed;
+
+  const jwtState = document.createElement('div');
+  jwtState.className = unsignedCallbacksAllowed ? 'alert alert-danger' : 'alert alert-success';
+  jwtState.style.marginTop = '12px';
+  jwtState.textContent = unsignedCallbacksAllowed
+    ? 'Security warning: unsigned ONLYOFFICE callbacks are temporarily allowed. Configure outgoing JWTs on the Document Server and remove ONLYOFFICE_ALLOW_UNSIGNED_CALLBACKS.'
+    : 'Callback JWT enforcement is enabled. Unsigned or invalid save callbacks are rejected.';
+  sec.appendChild(jwtState);
 
   const enabledEl = document.getElementById('ooEnabled');
   const originEl = document.getElementById('ooDocsOrigin');

public/js/authModals.js

@@ -262,11 +262,22 @@ function loadTOTPQRCode() {
     credentials: "include",
     headers: { "X-CSRF-Token": window.csrfToken }
   })
-    .then(res => {
-      if (!res.ok) throw new Error("Failed to fetch QR code: " + res.status);
+    .then(async res => {
+      if (!res.ok) {
+        const contentType = res.headers.get("content-type") || "";
+        const payload = contentType.includes("application/json")
+          ? await res.json().catch(() => ({}))
+          : {};
+        if (payload.reauth_required) {
+          window.location.href = withBase("/index.html");
+          return null;
+        }
+        throw new Error(payload.error || "Failed to fetch QR code: " + res.status);
+      }
       return res.blob();
     })
     .then(blob => {
+      if (!blob) return;
       const url = URL.createObjectURL(blob);
       document.getElementById("totpQRCodeImage").src = url;
     })

public/js/i18n.js

@@ -155,6 +155,9 @@ const translations = {
     "login": "Login",
     "remember_me": "Remember me",
     "login_oidc": "Login with OIDC",
+    "oidc_link_confirm_button": "Confirm and link OIDC",
+    "oidc_link_cancel_button": "Cancel account linking",
+    "oidc_link_confirm_prompt": "Confirm the local password for “{username}” to securely link this OIDC identity.",
     "basic_http_login": "Use Basic HTTP Login",
 
     // Change Password keys: