peer-term 1.3.4 → 1.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peer-term",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "license": "MIT",
   "description": "Share your terminal instantly using a 6-digit code. Encrypted. No config.",
   "repository": {

package/src/index.js

@@ -41,7 +41,7 @@ import {
   decrypt,
 } from './crypto.js';
 import { HostWebRTC } from './webrtc.js';
-import logger, { writeToErrorLog } from './logger.js';
+import logger from './logger.js';
 import { printBanner, printSessionBox, printHelp, printVersion } from './ui.js';
 
 // ─── File paths ──────────────────────────────────────────────────────────────
@@ -613,6 +613,10 @@ class Session {
               try {
                 const parsedMsg = JSON.parse(plaintext);
                 if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                  if (this.readOnly) {
+                    this._sendFileError(parsedMsg.id, 'File uploads are disabled in read-only mode');
+                    return;
+                  }
                   this._handleFileMessage(parsedMsg);
                   return;
                 }
@@ -846,6 +850,12 @@ class Session {
    * All file messages arrive over the DataChannel only.
    */
   _handleFileMessage(msg) {
+    // Defense-in-depth: reject all file operations in read-only sessions
+    if (this.readOnly) {
+      this._sendFileError(msg.id, 'File uploads are disabled in read-only mode');
+      return;
+    }
+
     switch (msg.type) {
       case 'file-start': {
         // Validate required fields
@@ -1370,6 +1380,10 @@ class Session {
             try {
               const parsedMsg = JSON.parse(plaintext);
               if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                if (this.readOnly) {
+                  this._sendFileError(parsedMsg.id, 'File uploads are disabled in read-only mode');
+                  return;
+                }
                 this._handleFileMessage(parsedMsg);
                 return;
               }
@@ -1527,6 +1541,10 @@ class Session {
         try {
           const msg = JSON.parse(plaintext);
           if (msg && typeof msg.type === 'string' && msg.type.startsWith('file-')) {
+            if (this.readOnly) {
+              this._sendFileError(msg.id, 'File uploads are disabled in read-only mode');
+              return;
+            }
             this._handleFileMessage(msg);
             return;
           }