aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
6 daysAdd `inline-menu-positioning-improvements` feature flag (#5313)HEADmainEphemera42
11 daysUse updated fern instead of patch (#5298)1.32.7Mathijs van Veluw
Signed-off-by: BlackDex <[email protected]>
12 daysAllow adding connect-src entries (#5293)Mathijs van Veluw
Bitwarden allows to use self-hosted forwarded email services. But for this to work you need to add custom URL's to the `connect-src` CSP entry. This commit allows setting this and checks if the URL starts with `https://` else it will abort loading. Fixes #5290 Signed-off-by: BlackDex <[email protected]>
13 daysSome refactoring and optimizations (#5291)Mathijs van Veluw
- Refactored several code to use more modern syntax - Made some checks a bit more strict - Updated crates Signed-off-by: BlackDex <[email protected]>
14 daysfeat: mask _smtp_img_src in support string (#5281)Helmut K. C. Tessarek
2024-12-10Some Backend Admin fixes and updates (#5272)1.32.6Mathijs van Veluw
* Some Backend Admin fixes and updates - Updated datatables - Added a `X-Robots-Tags` header to prevent indexing - Modified some layout settings - Added Websocket check to diagnostics - Added Security Header checks to diagnostics - Added Error page response checks to diagnostics - Modifed support string layout a bit Signed-off-by: BlackDex <[email protected]> * Some small fixes Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-12-10Update crates (#5268)Daniel
- fixes CVE-2024-12224
2024-12-08Fix another sync issue with native clients (#5259)Mathijs van Veluw
The `reprompt` value somehow sometimes has a value of `4`. This isn't a valid value, and doesn't cause issues with other clients, but the native clients are more strict. This commit fixes this by validating the value before storing and returning. Signed-off-by: BlackDex <[email protected]>
2024-12-06Update Alpine to version 3.21 (#5256)Daniel
2024-12-05Update Rust and crates (#5248)Mathijs van Veluw
* Update Rust and crates - Updated Rust to v1.83.0 - Updated MSRV to v1.82.0 (Needed for html5gum crate) - Updated icon fetching code to match new html5gum version - Updated workflows - Enabled edition 2024 clippy lints Nightly reports some clippy hints, but that would be too much to change in this PR i think. Signed-off-by: BlackDex <[email protected]> * Some additional updates - Patch fern to allow syslog-7 feature - Fixed diesel logger which was broken because of the sqlite backup feature Refactored the sqlite backup because of this - Added a build workflow test to include the query_logger feature Signed-off-by: BlackDex <[email protected]> * Also patch yubico-rs and latest updates Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-11-25chore: fix some comments (#5224)chuangjinglu
Signed-off-by: chuangjinglu <[email protected]>
2024-11-20Fix editing members which have access-all rights (#5213)Mathijs van Veluw
With web-vault v2024.6.2 and lower, if a user has access-all rights either as an org-member or via a group it shouldn't return individual collections. This probably needs to be changed with newer versions which do not support the `access-all` feature anymore and work with manage. But with the current version this should solve access right issues. Fixes #5212 Signed-off-by: BlackDex <[email protected]>
2024-11-20Fix push not working (#5214)Mathijs van Veluw
The new native mobile clients seem to use PascalCase for the push payload. Also the date/time could cause issues. This PR fixes this by formatting the date/time correctly and use PascalCase for the payload key's I now receive cipher updates and login-with-device requests again. Fixes #5182 Signed-off-by: BlackDex <[email protected]>
2024-11-17Fix Org Import duplicate collections (#5200)1.32.5Mathijs van Veluw
This fixes an issue with collections be duplicated same as was an issue with folders. Also made some optimizations by using HashSet where possible and device the Vec/Hash capacity. And instead of passing objects only use the UUID which was the only value we needed. Also found an issue with importing a personal export via the Org import where folders are used. Since Org's do not use folder we needed to clear those out, same as Bitwarden does. Fixes #5193 Signed-off-by: BlackDex <[email protected]>
2024-11-15Support SSH keys on desktop 2024.12 (#5187)Daniel García
* Support SSH keys on desktop 2024.12 * Document flags in .env.template * Validate key rotation contents
2024-11-15Some more authrequest changes (#5188)Daniel García
2024-11-13don't infer manage permission for groups (#5190)Stefan Melmuk
the web-vault v2024.6.2 currently cannot deal with manage permission so instead of relying on the org user type this should just default to false
2024-11-12fix password hint check (#5189)Stefan Melmuk
* fix password hint check don't show password hints if you have disabled the hints with PASSWORD_HINTS_ALLOWED=false or if you have not configured mail and opted into showing password hints * update descriptions for pw hints options
2024-11-12Remove auth-request deletion (#5184)Mathijs van Veluw
2FA is needed to login even when using login-with-device. If the user didn't saved the 2FA token they still need to provide this. We deleted the auth-request after validation the request, but before 2FA was triggered. Removing the deletion of this record from that point as it will get cleaned-up automatically anyways. Signed-off-by: BlackDex <[email protected]>
2024-11-12fix hibp username encoding and pw hint check (#5180)Mathijs van Veluw
* fix hibp username encoding Signed-off-by: BlackDex <[email protected]> * Fix password-hint check Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-11-11Add dynamic CSS support (#4940)Mathijs van Veluw
* Add dynamic CSS support Together with https://github.com/dani-garcia/bw_web_builds/pull/180 this PR will add support for dynamic CSS changes. For example, we could hide the register link if signups are not allowed. In the future show or hide the SSO button depending on if it is enabled or not. There also is a special `user.vaultwarden.scss` file so that users can add custom CSS without the need to modify the default (static) changes. This will prevent future changes from not being applied and still have the custom user changes to be added. Also added a special redirect when someone goes directly to `/index.html` as that might cause issues with loading other scripts and files. Signed-off-by: BlackDex <[email protected]> * Add versions and fallback to built-in - Add both Vaultwarden and web-vault versions to the css_options. - Fallback to the inner templates if rendering or compiling the scss fails. This ensures the basics are always working even if someone breaks the templates. Signed-off-by: BlackDex <[email protected]> * Fix fallback code to actually work The fallback now works by using an alternative `reg!` macro. This adds an extra template register which prefixes the template with `fallback_`. Signed-off-by: BlackDex <[email protected]> * Updated the wiki link in the user template --------- Signed-off-by: BlackDex <[email protected]>
2024-11-11More authrequest fixes (#5176)Daniel García
2024-11-11Fix if logic error (#5171)Mathijs van Veluw
Fixing a logical error in an if statement where we used `&&` which should have been `||`. Signed-off-by: BlackDex <[email protected]>
2024-11-10Limit HIBP to authed users1.32.4Daniel García
2024-11-10Update crates and fix several issuesBlackDex
Signed-off-by: BlackDex <[email protected]>
2024-11-02Update README (#5153)Mathijs van Veluw
Updating the Readme to be more modern and more clear. Added and moved several shields/badges and changed some default colors to have a better contrast. Added a Disclaimer section. Closes #4901 Closes #4930 Closes #4931 Closes #5024 Co-authored-by: ipitio <[email protected]> Co-authored-by: Robert Schütz <[email protected]> Co-authored-by: Yonas Yanfa <[email protected]> Co-authored-by: KUSUMA RUSHIKESH <[email protected]>
2024-10-24Update crates and fix Mail issue (#5125)1.32.3Mathijs van Veluw
- Updated all the crates Including in this update is an update from lettre, which solves an issue with some specific SMTP mail providers.
2024-10-21Add documentation for the `extension-refresh` feature flag (#5112)Daniel
2024-10-19Hide user name on invite status (#5110)Mathijs van Veluw
A possible user disclosure when you invite an user into an organization which already has an account on the same instance. This was because we always returned the user's name. To prevent this, this PR only returns the user's name if the status is accepted or higher, else we will return null. This is the same as Bitwarden does. Resolves a reported issue. Also resolved a new `nightly` reported clippy regarding a regex within a loop.
2024-10-19Add `extension-refresh` feature flag (#5106)Daniel
- in case people want to try out the new extension design
2024-10-18Fix collection management and match some json output (#5095)Mathijs van Veluw
- Fixed collection management to be usable from the Password Manager UI - Checked and brought in-to-sync with upstream several json responses - Fixed a small issue with the `fields` response when it was empty Signed-off-by: BlackDex <[email protected]>
2024-10-18Update Rust to 1.82.0 (#5099)Daniel
- raise MSRV to 1.80.0 - also update the crates
2024-10-18Fix org invite url being html encoded (#5100)Mathijs van Veluw
Ever since we changed to pass the full url as a template value handlebars now html-encodes this. This causes issues with the plain/text mails, but it also could potentially cause issues with the text/html templates. This PR encloses the template values inside triple braces `{{{ }}}` which prevents html-encoding. Since the URL is generated via the `url` crate the values are percent-encoded anyway. Fixes #5097 Signed-off-by: BlackDex <[email protected]>
2024-10-13Fix field type to actually be hidden (#5082)Mathijs van Veluw
In an oversight i forgot to set the type to a hidden type if converting the int was not possible. This fixes that. Signed-off-by: BlackDex <[email protected]>
2024-10-13Fix iOS sync by converting field types to int (#5081)Mathijs van Veluw
It seems the iOS clients are not able to handle the `type` key within the `fields` array when they are of the type string. All other clients seem to handle this just fine though. This PR fixes this by validating it is a number, if this is not the case, try to convert the string to a number, or return the default of `1`. `1` is used as this is the type `hidden` and should prevent accidental data disclosure. Fixes #5069 Possibly Fixes #5016 Possibly Fixes #5002 Signed-off-by: BlackDex <[email protected]>
2024-10-11Fix `--version` from failing without config (#5055)1.32.2Mathijs van Veluw
* Fix `--version` from failing without config Since we added the option to show the web-vault version also when running `--version` this causes the config to always be validated. While this is not very bad in general, it could cause the command to quit during the config validation, and not show the version, but also errors. This is probably not very useful for this specific command, unlike the `--backup` for example. To fix this, and preventing the config from being validated, i added an AtomicBool to check if we need to validate the config on first load. This prevents errors, and will just show the Vaultwarden version, and if possible the web-vault version too. Fixes #5046 Signed-off-by: BlackDex <[email protected]> * Adjusted the code bsaed upon review Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-10-11Updates and collection management fixes (#5072)Mathijs van Veluw
* Fix collections not editable by managers Since a newer version of the web-vault we use manager were not able to create sub collections anymore. This was because of some missing details in the response of some json objects. This commit fixes this by using the `to_json_details` instead of the `to_json` Fixes #5066 Fixes #5044 * Update crates and GitHub Actions - Updated all the crates - Updated all the GHA dependencies - Configured the trivy workflow to only run on the main repo and not on forks Also selected a random new scheduled date so it will not run at the same time as all other forks. The two changes should help running this scan every day without failing, and also prevent the same for new or updated forks.
2024-10-06Fix compiling for Windows targets (#5053)Mathijs van Veluw
The `unix::signal` was also included during Windows compilations. This of course will not work. Fix this by only including it for `unix` targets. Also changed all other conditional compilation options to use `cfg(unix)` instead of `cfg(not(windows))`. The latter may also include `wasm` for example, or any other future target family. This way we will only match `unix` Fixes #5052
2024-09-23Add extra linting (#4977)1.32.1Mathijs van Veluw
* Add extra linting Added extra linting for some code styles. Also added the Rust Edition 2024 lints. Closes #4974 Signed-off-by: BlackDex <[email protected]> * Adjusted according to comments Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-09-20Fix keyword collision in Rust 2024 and add new api/config value (#4975)Daniel García
* Avoid keyword collision with gen in Rust 2024 * Include new api/config setting to disable user registration, not yet used by clients * Actually qualify CONFIG
2024-09-20Fix encrypted lastUsedDate (#4972)Mathijs van Veluw
It appears that some password histories have an encrypted value on the `lastUsedDate` Instead of only checking if it is a string, also check if it is a valid RFC Date/Time String. If not, set it also to epoch 0. Signed-off-by: BlackDex <[email protected]>
2024-09-20Fix Device Type column for 2FA migration (#4971)Mathijs van Veluw
2024-09-19remove backtics from postgresql migrations (#4968)Stefan Melmuk
2024-09-18Actually use Device Type for mails (#4916)Daniel
- match Bitwarden behaviour - add a different segment in mails for Device Name
2024-09-18fix 2fa policy check on registration (#4956)Stefan Melmuk
2024-09-18Fix Pw History null dates (#4966)Mathijs van Veluw
It seemed to have been possible to have `null` date values. This PR fixes this by setting the epoch start date if either the date does not exists or is not a string. This should solve sync issues with the new native mobile clients. Fixes https://github.com/dani-garcia/vaultwarden/pull/4932#issuecomment-2357581292 Signed-off-by: BlackDex <[email protected]>
2024-09-13fix invitation link via /admin (#4950)Stefan Melmuk
2024-09-10Fix collection update from native client (#4937)Mathijs van Veluw
2024-09-09Fix sync with new native clients (#4932)Mathijs van Veluw
2024-09-07Update Rust version & crates (#4928)Daniel
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 12:04:36 +0000