# Freeloader audit patches — for N5AD review

Reviewed and patched **2026-07-30**. These files are proposed drops into the Freeloader repo / install tree. Compare against your current `main`, then incorporate what you agree with.

**Live audit page:** [index.php](./index.php) (this directory)  
**Patched sources:** [patches/](./patches/)

## How to use

1. Diff each file in `patches/` against your GitHub tree.
2. Copy accepted files into the repo.
3. Re-run `sudo bash freeloader.sh` (or at least reinstall `freeloader-helper` + web files) so both the PHP allowlist and the helper allowlist stay in sync.

## Fixes included

| Issue | Change |
|---|---|
| `/usr/local/bin` on allowlist | Removed from `freeloader_common.php` and `freeloader-helper.sh` |
| Freeloader web root writable | Removed `/var/www/html/freeloader` from both allowlists |
| Dangerous extensions not blocked | Enforced on upload, save, and inside the helper `cp` command |
| Save ignored editable patterns | `get` / `save` now require editable pattern + non-dangerous name |
| `addslashes` in onclick | Uses `json_encode()` for filenames |
| Session cookie flags | `freeloader_bootstrap_session()` sets HttpOnly, Secure (when HTTPS), SameSite=Strict |
| Plaintext password fallback | Removed — bcrypt hash only |
| jQuery CDN without SRI | Added `integrity` + `crossorigin` |
| Incomplete UI tooltip | Built from `freeloader_allowed_dirs_label()` |
| `.htaccess` editable vs hidden | Dropped from editable patterns; still blocked as dangerous |
| Content-Disposition injection | Sanitized via `freeloader_content_disposition()` |
| README clarity | Typos fixed; allowlist / edit rules documented |

## Files in `patches/`

- `freeloader_common.php`
- `freeloader-helper.sh`
- `freeloader_upload.php`
- `freeloader_download.php`
- `freeloader_delete.php`
- `freeloader.inc`
- `index.php`
- `README.md`

## Intentionally kept

- `/var/www/html/supermon` remains allowed (common ASL admin need), but `.php` / other dangerous types cannot be uploaded or saved there.
- Download/delete of existing non-dangerous files under allowed dirs still works as before.

## Viewing source in the browser

Apache executes `.php` under this site, so use the `.txt` copies to read source in a browser:

- Example: [patches/freeloader_common.php.txt](./patches/freeloader_common.php.txt)

Or download everything as a zip:

- [freeloader-audit-patches.zip](./freeloader-audit-patches.zip)