v3.0.7

use crypto.timingSafeEqual in hmac and ownerToken authentication
Pontoon: Update Interlingua (ia) localization of Firefox Send
2025-12-06 22:20:55 +03:00 · 2019-03-15 09:40:03 -07:00 · 2019-03-14 22:09:34 -07:00 · 2019-03-14 23:52:14 +00:00 · 2019-03-14 14:54:37 -07:00 · 2019-03-14 21:52:00 +00:00
9 changed files with 297 additions and 35 deletions
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
  "name": "firefox-send",
-  "version": "3.0.6",
+  "version": "3.0.7",
  "lockfileVersion": 1,
  "requires": true,
  "dependencies": {
@@ -2413,8 +2413,7 @@
    "buffer-crc32": {
      "version": "0.2.13",
      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI=",
-      "dev": true
+      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI="
    },
    "buffer-equal-constant-time": {
      "version": "1.0.1",
@@ -5863,8 +5862,7 @@
    "fs-constants": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
-      "dev": true
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow=="
    },
    "fs-extra": {
      "version": "4.0.3",
@@ -8054,8 +8052,7 @@
    "isexe": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
-      "dev": true
+      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA="
    },
    "isobject": {
      "version": "3.0.1",
@@ -8305,6 +8302,15 @@
      "integrity": "sha512-s5kLOcnH0XqDO+FvuaLX8DDjZ18CGFk7VygH40QoKPUQhW4e2rvM0rwUq0t8IQDOwYSeLK01U90OjzBTme2QqA==",
      "dev": true
    },
+    "klaw": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/klaw/-/klaw-1.3.1.tgz",
+      "integrity": "sha1-QIhDO0azsbolnXh4XY6W9zugJDk=",
+      "dev": true,
+      "requires": {
+        "graceful-fs": "^4.1.9"
+      }
+    },
    "known-css-properties": {
      "version": "0.11.0",
      "resolved": "https://registry.npmjs.org/known-css-properties/-/known-css-properties-0.11.0.tgz",
@@ -9616,8 +9622,7 @@
    "nice-try": {
      "version": "1.0.5",
      "resolved": "https://registry.npmjs.org/nice-try/-/nice-try-1.0.5.tgz",
-      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
-      "dev": true
+      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ=="
    },
    "nise": {
      "version": "1.4.10",
@@ -11426,8 +11431,7 @@
    "path-key": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz",
-      "integrity": "sha1-QRyttXTFoUDTpLGRDUDYDMn0C0A=",
-      "dev": true
+      "integrity": "sha1-QRyttXTFoUDTpLGRDUDYDMn0C0A="
    },
    "path-parse": {
      "version": "1.0.6",
@@ -11475,8 +11479,7 @@
    "pend": {
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
-      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA=",
-      "dev": true
+      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA="
    },
    "perfectionist": {
      "version": "2.4.0",
@@ -12778,8 +12781,7 @@
    "progress": {
      "version": "2.0.3",
      "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
-      "integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==",
-      "dev": true
+      "integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA=="
    },
    "promise-inflight": {
      "version": "1.0.1",
@@ -12915,6 +12917,15 @@
          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
          "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg==",
          "dev": true
+        },
+        "ws": {
+          "version": "6.2.0",
+          "resolved": "https://registry.npmjs.org/ws/-/ws-6.2.0.tgz",
+          "integrity": "sha512-deZYUNlt2O4buFCa3t5bKLf8A7FPP/TVjwOeVNpw818Ma5nk4MLXls2eoEGS39o8119QIYxTrTDoPQ5B/gTD6w==",
+          "dev": true,
+          "requires": {
+            "async-limiter": "~1.0.0"
+          }
        }
      }
    },
@@ -13840,6 +13851,130 @@
      "integrity": "sha1-Yl2GWPhlr0Psliv8N2o3NZpJlMo=",
      "dev": true
    },
+    "selenium-standalone": {
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/selenium-standalone/-/selenium-standalone-6.16.0.tgz",
+      "integrity": "sha512-tl7HFH2FOxJD1is7Pzzsl0pY4vuePSdSWiJdPn+6ETBkpeJDiuzou8hBjvWYWpD+eIVcOrmy3L0R3GzkdHLzDw==",
+      "requires": {
+        "async": "^2.6.2",
+        "commander": "^2.19.0",
+        "cross-spawn": "^6.0.5",
+        "debug": "^4.1.1",
+        "lodash": "^4.17.11",
+        "minimist": "^1.2.0",
+        "mkdirp": "^0.5.1",
+        "progress": "2.0.3",
+        "request": "2.88.0",
+        "tar-stream": "2.0.0",
+        "urijs": "^1.19.1",
+        "which": "^1.3.1",
+        "yauzl": "^2.10.0"
+      },
+      "dependencies": {
+        "async": {
+          "version": "2.6.2",
+          "resolved": "https://registry.npmjs.org/async/-/async-2.6.2.tgz",
+          "integrity": "sha512-H1qVYh1MYhEEFLsP97cVKqCGo7KfCyTt6uEWqsTBr9SO84oK9Uwbyd/yCW+6rKJLHksBNUVWZDAjfS+Ccx0Bbg==",
+          "requires": {
+            "lodash": "^4.17.11"
+          }
+        },
+        "bl": {
+          "version": "2.2.0",
+          "resolved": "https://registry.npmjs.org/bl/-/bl-2.2.0.tgz",
+          "integrity": "sha512-wbgvOpqopSr7uq6fJrLH8EsvYMJf9gzfo2jCsL2eTy75qXPukA4pCgHamOQkZtY5vmfVtjB+P3LNlMHW5CEZXA==",
+          "requires": {
+            "readable-stream": "^2.3.5",
+            "safe-buffer": "^5.1.1"
+          },
+          "dependencies": {
+            "readable-stream": {
+              "version": "2.3.6",
+              "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.6.tgz",
+              "integrity": "sha512-tQtKA9WIAhBF3+VLAseyMqZeBjW0AHJoxOtYqSUZNJxauErmLbVm2FW1y+J/YA9dUrAC39ITejlZWhVIwawkKw==",
+              "requires": {
+                "core-util-is": "~1.0.0",
+                "inherits": "~2.0.3",
+                "isarray": "~1.0.0",
+                "process-nextick-args": "~2.0.0",
+                "safe-buffer": "~5.1.1",
+                "string_decoder": "~1.1.1",
+                "util-deprecate": "~1.0.1"
+              }
+            }
+          }
+        },
+        "commander": {
+          "version": "2.19.0",
+          "resolved": "https://registry.npmjs.org/commander/-/commander-2.19.0.tgz",
+          "integrity": "sha512-6tvAOO+D6OENvRAh524Dh9jcfKTYDQAqvqezbCW82xj5X0pSrcpxtvRKHLG0yBY6SD7PSDrJaj+0AiOcKVd1Xg=="
+        },
+        "cross-spawn": {
+          "version": "6.0.5",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz",
+          "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==",
+          "requires": {
+            "nice-try": "^1.0.4",
+            "path-key": "^2.0.1",
+            "semver": "^5.5.0",
+            "shebang-command": "^1.2.0",
+            "which": "^1.2.9"
+          }
+        },
+        "debug": {
+          "version": "4.1.1",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz",
+          "integrity": "sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==",
+          "requires": {
+            "ms": "^2.1.1"
+          }
+        },
+        "fd-slicer": {
+          "version": "1.1.0",
+          "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+          "integrity": "sha1-JcfInLH5B3+IkbvmHY85Dq4lbx4=",
+          "requires": {
+            "pend": "~1.2.0"
+          }
+        },
+        "ms": {
+          "version": "2.1.1",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
+          "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
+        },
+        "readable-stream": {
+          "version": "3.2.0",
+          "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.2.0.tgz",
+          "integrity": "sha512-RV20kLjdmpZuTF1INEb9IA3L68Nmi+Ri7ppZqo78wj//Pn62fCoJyV9zalccNzDD/OuJpMG4f+pfMl8+L6QdGw==",
+          "requires": {
+            "inherits": "^2.0.3",
+            "string_decoder": "^1.1.1",
+            "util-deprecate": "^1.0.1"
+          }
+        },
+        "tar-stream": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.0.0.tgz",
+          "integrity": "sha512-n2vtsWshZOVr/SY4KtslPoUlyNh06I2SGgAOCZmquCEjlbV/LjY2CY80rDtdQRHFOYXNlgBDo6Fr3ww2CWPOtA==",
+          "requires": {
+            "bl": "^2.2.0",
+            "end-of-stream": "^1.4.1",
+            "fs-constants": "^1.0.0",
+            "inherits": "^2.0.3",
+            "readable-stream": "^3.1.1"
+          }
+        },
+        "yauzl": {
+          "version": "2.10.0",
+          "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+          "integrity": "sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=",
+          "requires": {
+            "buffer-crc32": "~0.2.3",
+            "fd-slicer": "~1.1.0"
+          }
+        }
+      }
+    },
    "selfsigned": {
      "version": "1.10.4",
      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-1.10.4.tgz",
@@ -14000,7 +14135,6 @@
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz",
      "integrity": "sha1-RKrGW2lbAzmJaMOfNj/uXer98eo=",
-      "dev": true,
      "requires": {
        "shebang-regex": "^1.0.0"
      }
@@ -14008,8 +14142,7 @@
    "shebang-regex": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-1.0.0.tgz",
-      "integrity": "sha1-2kL0l0DAtC2yypcoVxyxkMmO/qM=",
-      "dev": true
+      "integrity": "sha1-2kL0l0DAtC2yypcoVxyxkMmO/qM="
    },
    "shell-quote": {
      "version": "1.6.1",
@@ -16199,6 +16332,11 @@
        "punycode": "^2.1.0"
      }
    },
+    "urijs": {
+      "version": "1.19.1",
+      "resolved": "https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz",
+      "integrity": "sha512-xVrGVi94ueCJNrBSTjWqjvtgvl3cyOTThp2zaMaFNGp3F542TR6sM3f2o8RqZl+AwteClSVmoCyt0ka4RjQOQg=="
+    },
    "urix": {
      "version": "0.1.0",
      "resolved": "https://registry.npmjs.org/urix/-/urix-0.1.0.tgz",
@@ -16576,6 +16714,40 @@
        "sauce-connect-launcher": "~1.2.3"
      }
    },
+    "wdio-selenium-standalone-service": {
+      "version": "0.0.12",
+      "resolved": "https://registry.npmjs.org/wdio-selenium-standalone-service/-/wdio-selenium-standalone-service-0.0.12.tgz",
+      "integrity": "sha512-R8iUL30SkFfZictAG5wRofeCsHQ4bIucDtaArCQWZkUqS+DlGTStIk3TaIOCaX7dS7UW1YN/lJt9Vsn4Ekmoxg==",
+      "dev": true,
+      "requires": {
+        "fs-extra": "^0.30.0",
+        "selenium-standalone": "^6.15.4"
+      },
+      "dependencies": {
+        "fs-extra": {
+          "version": "0.30.0",
+          "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-0.30.0.tgz",
+          "integrity": "sha1-8jP/zAjU2n1DLapEl3aYnbHfk/A=",
+          "dev": true,
+          "requires": {
+            "graceful-fs": "^4.1.2",
+            "jsonfile": "^2.1.0",
+            "klaw": "^1.0.0",
+            "path-is-absolute": "^1.0.0",
+            "rimraf": "^2.2.8"
+          }
+        },
+        "jsonfile": {
+          "version": "2.4.0",
+          "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-2.4.0.tgz",
+          "integrity": "sha1-NzaitCi4e72gzIO1P6PWM6NcKug=",
+          "dev": true,
+          "requires": {
+            "graceful-fs": "^4.1.6"
+          }
+        }
+      }
+    },
    "wdio-spec-reporter": {
      "version": "0.1.5",
      "resolved": "https://registry.npmjs.org/wdio-spec-reporter/-/wdio-spec-reporter-0.1.5.tgz",
@@ -17284,7 +17456,6 @@
      "version": "1.3.1",
      "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
-      "dev": true,
      "requires": {
        "isexe": "^2.0.0"
      }
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
  "name": "firefox-send",
  "description": "File Sharing Experiment",
-  "version": "3.0.6",
+  "version": "3.0.7",
  "author": "Mozilla (https://mozilla.org)",
  "repository": "mozilla/send",
  "homepage": "https://github.com/mozilla/send/",
--- a/public/locales/cak/send.ftl
+++ b/public/locales/cak/send.ftl
@@ -78,7 +78,17 @@ fileCount =
        [one] 1 yakb'äl
       *[other] { $num } taq yakb'äl
    }
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# byte abbreviation
+bytes = B
+# kibibyte abbreviation
+kb = KB
+# mebibyte abbreviation
+mb = MB
+# gibibyte abbreviation
+gb = GB
+# localized number and byte abbreviation. example "2.5MB"
+fileSize = { $num }{ $units }
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 totalSize = Ronojel runimilem: { $size }
 # the next line after the colon contains a file name
 copyLinkDescription = Tawachib'ej ri ximonel richin nakomonij ri ayakb'al:
@@ -110,15 +120,15 @@ uploadButton = Tijotob'äx
 # the first part of the string 'Drag and drop files or click to send up to 1GB'
 dragAndDropFiles = Keqirirëx chuqa' ke'osq'opïx taq yakb'äl
 # the second part of the string 'Drag and drop files or click to send up to 1GB'
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 orClickWithSize = o tapitz'a' richin natäq k'a { $size }
 addPassword = Tichajïx rik'in ewan tzij
 emailPlaceholder = Tatz'ib'aj ataqoya'l
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 signInSizeBump = Tatikirisaj molojri'ïl richin natäq k'a { $size }
 signInButton = Tatikirisaj molojri'ïl/tatz'ib'aj ab'i'
 accountBenefitTitle = Tatz'uku' jun { -firefox } Rub'i' Ataqoy'al o Tatikirisaj molojri'ïl
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 accountBenefitLargeFiles = Ke'akomonij taq yakb'äl k'a { $size }
 accountBenefitDownloadCount = Ke'akomonij taq yakb'äl kik'in ch'aqa' chik winaqi'
 accountBenefitTimeLimit =
--- a/public/locales/es-CL/send.ftl
+++ b/public/locales/es-CL/send.ftl
@@ -75,6 +75,16 @@ fileCount =
        [one] 1 archivo
       *[other] { $num } archivos
    }
+# byte abbreviation
+bytes = B
+# kibibyte abbreviation
+kb = KB
+# mebibyte abbreviation
+mb = MB
+# gibibyte abbreviation
+gb = GB
+# localized number and byte abbreviation. example "2.5MB"
+fileSize = { $num }{ $units }
 # $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 totalSize = Tamaño total: { $size }
 copyLinkButton = Copiar enlace
@@ -83,8 +93,27 @@ expiredTitle = Este enlace ha expirado.
 downloadFirefox = Bajar { -firefox }
 # A short representation of a countdown timer containing the number of days, hours, and minutes remaining as digits, example "2d 11h 56m"
 expiresDaysHoursMinutes = { $days }d { $hours }h { $minutes }m
+addFilesButton = Selecciona los archivos a subir
 uploadButton = Subir
+# the first part of the string 'Drag and drop files or click to send up to 1GB'
+dragAndDropFiles = Arrastra y suelta archivos
+# the second part of the string 'Drag and drop files or click to send up to 1GB'
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
+orClickWithSize = o haz clic para enviar hasta { $size }
+addPassword = Protegido con contraseña
+emailPlaceholder = Ingresa tu correo
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
+signInSizeBump = Conéctate para enviar hasta { $size }
+signInButton = Conectarse/registrarse
+accountBenefitTitle = Crea una cuenta de { -firefox } o conéctate
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
+accountBenefitLargeFiles = Comparte archivos de hasta { $size }
+accountBenefitDownloadCount = Comparte archivos con más personas
+accountBenefitMoz = Aprender más acerca de otros servicios de { -mozilla }
 signOut = Salir
+okButton = Aceptar
 downloadingTitle = Bajando
+noStreamsWarning = Es posible que este navegador no pueda descifrar un archivo tan grande.
+noStreamsOptionCopy = Copiar el enlace para abrirlo en otro navegador
 noStreamsOptionFirefox = Prueba nuestro navegador favorito
 noStreamsOptionDownload = Continuar con este navegador
--- a/public/locales/ia/send.ftl
+++ b/public/locales/ia/send.ftl
@@ -90,6 +90,18 @@ totalSize = Dimension total: { $size }
 copyLinkDescription = Copia le ligamine pro compartir le file:
 copyLinkButton = Copiar ligamine
 downloadTitle = Discargar files
+# count will always be > 10
+tooManyFiles =
+    { $count ->
+        [one] Solo 1 file al vice pote ser cargate.
+       *[other] Solo { $count } files al vice pote ser cargate.
+    }
+# count will always be > 10
+tooManyArchives =
+    { $count ->
+        [one] Solo 1 archivo es consentite.
+       *[other] Solo { $count } archivos es consentite.
+    }
 expiredTitle = Iste ligamine ha expirate.
 downloadFirefox = Discargar { -firefox }
 legalTitle = Politica de confidentialitate de { -send-short-brand }
--- a/public/locales/sk/send.ftl
+++ b/public/locales/sk/send.ftl
@@ -84,7 +84,17 @@ fileCount =
        [few] { $num } súbory
       *[other] { $num } súborov
    }
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# byte abbreviation
+bytes = B
+# kibibyte abbreviation
+kb = kB
+# mebibyte abbreviation
+mb = MB
+# gibibyte abbreviation
+gb = GB
+# localized number and byte abbreviation. example "2.5MB"
+fileSize = { $num } { $units }
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 totalSize = Celková veľkosť: { $size }
 # the next line after the colon contains a file name
 copyLinkDescription = Súbor môžete zdieľať pomocou tohto odkazu:
@@ -118,15 +128,15 @@ uploadButton = Nahrať
 # the first part of the string 'Drag and drop files or click to send up to 1GB'
 dragAndDropFiles = Pretiahnutím súboru alebo kliknutím sem
 # the second part of the string 'Drag and drop files or click to send up to 1GB'
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 orClickWithSize = môžete poslať až { $size }
 addPassword = Chrániť heslom
 emailPlaceholder = Zadajte e-mailovú adresu
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 signInSizeBump = Pre odoslanie súborov s veľkosťou až { $size }, sa, prosím, prihláste
 signInButton = Prihlásiť sa/Zaregistrovať sa
 accountBenefitTitle = Vytvorte si účet { -firefox } alebo sa prihláste
-# size is a localized number followed by a unit of bytes, ex. 2.5GB
+# $size is the size of the file, displayed using the fileSize message as format (e.g. "2.5MB")
 accountBenefitLargeFiles = Zdieľanie súborov s veľkosťou až { $size }
 accountBenefitDownloadCount = Zdieľanie súborov s viacerými ľuďmi
 accountBenefitTimeLimit =
--- a/server/middleware/auth.js
+++ b/server/middleware/auth.js
@@ -1,3 +1,4 @@
+const assert = require('assert');
 const crypto = require('crypto');
 const storage = require('../storage');
 const fxa = require('../fxa');
@@ -19,7 +20,7 @@ module.exports = {
        );
        hmac.update(Buffer.from(meta.nonce, 'base64'));
        const verifyHash = hmac.digest();
-        if (verifyHash.equals(Buffer.from(auth, 'base64'))) {
+        if (crypto.timingSafeEqual(verifyHash, Buffer.from(auth, 'base64'))) {
          req.nonce = crypto.randomBytes(16).toString('base64');
          storage.setField(id, 'nonce', req.nonce);
          res.set('WWW-Authenticate', `send-v1 ${req.nonce}`);
@@ -48,7 +49,11 @@ module.exports = {
        if (!req.meta) {
          return res.sendStatus(404);
        }
-        req.authorized = req.meta.owner === ownerToken;
+        const metaOwner = Buffer.from(req.meta.owner, 'utf8');
+        const owner = Buffer.from(ownerToken, 'utf8');
+        assert(metaOwner.length > 0);
+        assert(metaOwner.length === owner.length);
+        req.authorized = crypto.timingSafeEqual(metaOwner, owner);
      } catch (e) {
        req.authorized = false;
      }
--- a/test/backend/owner-tests.js
+++ b/test/backend/owner-tests.js
@@ -32,7 +32,7 @@ describe('Owner Middleware', function() {
    const next = sinon.stub();
    storage.metadata.returns(Promise.resolve(null));
    const res = response();
-    await ownerMiddleware(request('x', 'y'), res);
+    await ownerMiddleware(request('a', 'y'), res, next);
    sinon.assert.notCalled(next);
    sinon.assert.calledWith(res.sendStatus, 404);
  });
@@ -42,7 +42,7 @@ describe('Owner Middleware', function() {
    const meta = { owner: 'y' };
    storage.metadata.returns(Promise.resolve(meta));
    const res = response();
-    await ownerMiddleware(request('x', null), res);
+    await ownerMiddleware(request('b', null), res, next);
    sinon.assert.notCalled(next);
    sinon.assert.calledWith(res.sendStatus, 401);
  });
@@ -52,7 +52,7 @@ describe('Owner Middleware', function() {
    const meta = { owner: 'y' };
    storage.metadata.returns(Promise.resolve(meta));
    const res = response();
-    await ownerMiddleware(request('x', 'z'), res);
+    await ownerMiddleware(request('c', 'z'), res, next);
    sinon.assert.notCalled(next);
    sinon.assert.calledWith(res.sendStatus, 401);
  });
@@ -61,7 +61,7 @@ describe('Owner Middleware', function() {
    const next = sinon.stub();
    storage.metadata.returns(Promise.reject(new Error()));
    const res = response();
-    await ownerMiddleware(request('x', 'y'), res);
+    await ownerMiddleware(request('d', 'y'), res, next);
    sinon.assert.notCalled(next);
    sinon.assert.calledWith(res.sendStatus, 401);
  });
@@ -70,7 +70,7 @@ describe('Owner Middleware', function() {
    const next = sinon.stub();
    const meta = { owner: 'y' };
    storage.metadata.returns(Promise.resolve(meta));
-    const req = request('x', 'y');
+    const req = request('e', 'y');
    const res = response();
    await ownerMiddleware(req, res, next);
    assert.equal(req.meta, meta);
--- a/test/integration/download-tests.js
+++ b/test/integration/download-tests.js
@@ -57,4 +57,29 @@ describe('Firefox Send', function() {
        .includes('Expires after 1 download')
    );
  });
+
+  it('should ensure that the downloaded file size matches the uploaded file size', function() {
+    browser.chooseFile(
+      homePage.uploadInput,
+      `${testFilesPath}/${testFiles[0]}`
+    );
+    // get the file size for upload
+    const uploadSize = fs.statSync(`${testFilesPath}/${testFiles[0]}`).size;
+
+    browser.waitForExist(homePage.uploadButton);
+    browser.click(homePage.uploadButton);
+
+    browser.waitForExist(homePage.shareUrl);
+    const downloadPage = new DownloadPage(browser.getValue(homePage.shareUrl));
+    downloadPage.open();
+    downloadPage.download();
+    browser.waitForExist(downloadPage.downloadComplete);
+
+    // get the file size for download
+    const downloadFile = path.join(downloadDir, `${testFiles[0]}`);
+    const downloadSize = fs.statSync(downloadFile).size;
+
+    // check if upload and download file sizes are equal
+    assert.equal(uploadSize, downloadSize);
+  });
 });
Author	SHA1	Message	Date
Danny Coates	d42d8f8b75	v3.0.7	2019-03-15 09:40:03 -07:00
Danny Coates	ebbb1d05d2	use crypto.timingSafeEqual in hmac and ownerToken authentication	2019-03-14 22:09:34 -07:00
Melo46	67b55d1477	Pontoon: Update Interlingua (ia) localization of Firefox Send Localization authors: - Melo46 <melo@carmu.com>	2019-03-14 23:52:14 +00:00
Danny Coates	e3391ca823	Merge pull request #1242 from mgalicer/fix-1130 [Integration-Test] Add test to ensure that file size stays consistent	2019-03-14 14:54:37 -07:00
ravmn	0cac3bd0dc	Pontoon: Update Spanish (Chile) (es-CL) localization of Firefox Send Localization authors: - victor.gonzalezro <victor.gonzalezro@gmail.com> - josotrix <josotrix@ravmn.cl> - ravmn <ravmn@ravmn.cl>	2019-03-14 21:52:00 +00:00
Juan Sián	78de0b7a22	Pontoon: Update Kaqchikel (cak) localization of Firefox Send Localization authors: - Juan Sián <ajtzibsyan@yahoo.com>	2019-03-14 21:51:56 +00:00
Juraj Cigáň	14308dc491	Pontoon: Update Slovak (sk) localization of Firefox Send Localization authors: - Juraj Cigáň <kusavica@gmail.com>	2019-03-14 21:31:50 +00:00
marigalicer	0012dec277	[Integration-Test] Add test to ensure that file size stays consistent fixes #1130	2019-03-13 16:03:44 -04:00