Freeloader audit

For N5AD · reviewed 2026-07-30 · repo https://github.com/n5ad/freeloader

Verdict: July hardening fixed the critical unauthenticated issues. Remaining authenticated risks are addressed in the patch set below for you to review and merge.

Patched sources are ready in ./patches/ — see CHANGES.md for the incorporate checklist.

Already solid (pre-patch)

Auth on every endpoint (upload, delete, download, list, save, restart)
CSRF tokens on state-changing actions
Restricted sudo helper instead of blanket cp/rm/chmod
Directory allowlist with realpath checks
Bcrypt password hash; config chmod 640 root:www-data
Login rate limiting + session regenerate on login
Installer ships download.php and common.php
Apache deny for /my_uploads script execution

Patched in this drop

Sev	Fix	Files
High	Removed /usr/local/bin from allowlists	`freeloader_common.php, freeloader-helper.sh`
High	Removed /var/www/html/freeloader from allowlists	`freeloader_common.php, freeloader-helper.sh`
High	Block dangerous extensions on upload, save, and helper cp	`upload.php, common.php, helper`
Medium	Save/get require editable patterns server-side	`freeloader_upload.php`
Medium	json_encode() for filenames in onclick handlers	`freeloader_upload.php`
Low	HttpOnly / Secure / SameSite session cookies	`freeloader_common.php, index.php`
Low	Removed plaintext password fallback	`index.php`
Low	jQuery CDN SRI integrity attribute	`index.php`
Low	Safe Content-Disposition filename header	`download.php, common.php`
Cleanup	UI allowlist tooltip from shared helper	`freeloader.inc`
Cleanup	README typos + allowlist documentation	`README.md`

Suggested incorporate order

Drop freeloader_common.php + freeloader-helper.sh together (allowlists must match).
Drop freeloader_upload.php, freeloader_download.php, freeloader_delete.php.
Drop index.php + freeloader.inc.
Optional: README.md.
Reinstall helper + web files via freeloader.sh.