summaryrefslogtreecommitdiff
path: root/src/config.rs
AgeCommit message (Collapse)Author
2024-10-19Add `extension-refresh` feature flag (#5106)Daniel
- in case people want to try out the new extension design
2024-10-11Fix `--version` from failing without config (#5055)1.32.2Mathijs van Veluw
* Fix `--version` from failing without config Since we added the option to show the web-vault version also when running `--version` this causes the config to always be validated. While this is not very bad in general, it could cause the command to quit during the config validation, and not show the version, but also errors. This is probably not very useful for this specific command, unlike the `--backup` for example. To fix this, and preventing the config from being validated, i added an AtomicBool to check if we need to validate the config on first load. This prevents errors, and will just show the Vaultwarden version, and if possible the web-vault version too. Fixes #5046 Signed-off-by: BlackDex <[email protected]> * Adjusted the code bsaed upon review Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-09-23Add extra linting (#4977)1.32.1Mathijs van Veluw
* Add extra linting Added extra linting for some code styles. Also added the Rust Edition 2024 lints. Closes #4974 Signed-off-by: BlackDex <[email protected]> * Adjusted according to comments Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-09-20Fix keyword collision in Rust 2024 and add new api/config value (#4975)Daniel García
* Avoid keyword collision with gen in Rust 2024 * Include new api/config setting to disable user registration, not yet used by clients * Actually qualify CONFIG
2024-08-30Allow enforcing Single Org with pw reset policy (#4903)Mathijs van Veluw
* Allow enforcing Single Org with pw reset policy Bitwarden only allows the Reset Password policy to be set when the Single Org policy is enabled already. This PR adds a check so that this can be enforced when a config option is enabled. Since Vaultwarden encouraged to use multiple orgs when groups were not available yet we should not enable this by default now. This might be something to do in the future. When enabled, it will prevent the Reset Password policy to be enabled if the Single Org policy is not enabled. It will also prevent the Single Org policy to be disabled if the Reset Password policy is enabled. Fixes #4855 Signed-off-by: BlackDex <[email protected]> * Removed some extra if checks Signed-off-by: BlackDex <[email protected]> --------- Signed-off-by: BlackDex <[email protected]>
2024-07-24Allow to increase the note size to 100_000 (#4772)Mathijs van Veluw
This PR adds a config option to allow the note size to increase to 100_000, instead of the default 10_000. Since this might cause issues with the clients (in the future), and will cause issues with importing into a Bitwarden server, i added warnings regarding this. Closes #3168
2024-07-24Add support for MFA with Duo's Universal Prompt (#4637)0x0fbc
* Add initial working Duo Universal Prompt support. * Add db schema and models for Duo 2FA state storage * store duo states in the database and validate during authentication * cleanup & comments * bump state/nonce length * replace stray use of TimeDelta * more cleanup * bind Duo oauth flow to device id, drop redundant device type handling * drop redundant alphanum string generation code * error handling cleanup * directly use JWT_VALIDITY_SECS constant instead of copying it to DuoClient instances * remove redundant explicit returns, rustfmt * rearrange constants, update comments, error message * override charset on duo state column to ascii for mysql * Reduce twofactor_duo_ctx state/nonce column size in postgres and maria * Add fixes suggested by clippy * rustfmt * Update to use the make_http_request * Don't handle OrganizationDuo * move Duo API endpoint fmt strings out of macros and into format! calls * Add missing indentation Co-authored-by: Daniel García <[email protected]> * remove redundant expiry check when purging Duo contexts --------- Co-authored-by: BlackDex <[email protected]> Co-authored-by: Daniel García <[email protected]>
2024-07-24Allow to override log level for specific target (#4305)Timshel
2024-07-24Update crates & fix crate vulnerability (#4771)Daniel
- fixes GHSA-q445-7m23-qrmw by updating openssl to version 0.10.66
2024-07-12Update admin interface (#4737)Mathijs van Veluw
- Updated datatables - Set Cookie Secure flag if the connection is https - Prevent possible XSS via Organization Name Converted all `innerHTML` and `innerText` to the Safe Sink version `textContent` - Removed `jsesc` function as handlebars escapes all these chars already and more by default
2024-07-12Improved HTTP client (#4740)Daniel García
* Improved HTTP client * Change config compat to use auto, rename blacklist * Fix wrong doc references
2024-03-17automatically use email address as 2fa provider (#4317)Stefan Melmuk
2024-03-17Remove custom WebSocket code (#4001)Mathijs van Veluw
* Remove custom WebSocket code Remove our custom WebSocket code and only use the Rocket code. Removed all options in regards to WebSockets Added a new option `WEBSOCKET_DISABLED` which defaults too `false`. This can be used to disable WebSockets if you really do not want to use it. * Addressed remarks given and some updates - Addressed comments given during review - Updated crates, including Rocket to the latest merged v0.5 changes - Removed an extra header which should not be sent for websocket connections * Updated suggestions and crates - Addressed the suggestions - Updated Rocket to latest rc4 Also made the needed code changes - Updated all other crates Pinned `openssl` and `openssl-sys` --------- Co-authored-by: Daniel García <[email protected]>
2024-03-17Improve JWT key initialization and avoid saving public key (#4085)Daniel García
2024-01-28err on invalid feature flag (#4263)Stefan Melmuk
* err on invalid feature flag * print all invalid flags and improve error message
2024-01-27Improve file limit handling (#4242)Daniel García
* Improve file limit handling * Oops * Update PostgreSQL migration * Review comments --------- Co-authored-by: BlackDex <[email protected]>
2024-01-12Update crates and fix icon issue (#4237)Mathijs van Veluw
- Fix icon download issue by removing the deflate feature - Updated all the crates - Updated Handlebars code Fixes #4224
2024-01-10improve emergency access when not enabled (#4227)Stefan Melmuk
* improve emergency access when not enabled * display note that emergency access is disabled
2024-01-01US or EU Data Region Selection (#3752)THONY
* add selection of data region for push * fix cargo check + rewrite config + add check url * fix clippy error * add comment in .env.template, adapt config.rs * Update .env.template Co-authored-by: William Desportes <[email protected]> * Update .env.template Co-authored-by: William Desportes <[email protected]> * Revert "Update .env.template" This reverts commit 5bed974ba7b9f481792d2228834585f053d47dc3. * Revert "Update .env.template" This reverts commit 0760eff95dfaf2a9cf97bb25f6cf7660bdf55173. * fix /connect/token to push identity * fix /connect/token to push identity * Fixed formatting when solving merge conflicts --------- Co-authored-by: William Desportes <[email protected]> Co-authored-by: Daniel García <[email protected]>
2024-01-01Allow customizing the featureStates (#4168)Philipp Kolberg
* Allow customizing the featureStates Use a comma separated list of features to enable using the FEATURE_FLAGS env variable * Move feature flag parsing to util * Fix formatting * Update supported feature flags * Rename feature_flags to experimental_client_feature_flags Additionally, use a caret (^) instead of an exclamation mark (!) to disable features * Fix formatting issue. * Add documentation to env template * Remove functionality to disable feature flags * Fix JSON key for feature states * Convert error to warning when feature flag is unrecognized * Simplify parsing of feature flags * Fix default value of feature flags in env template * Fix formatting
2023-11-12Add Protected Actions Check (#4067)Mathijs van Veluw
Since the feature `Login with device` some actions done via the web-vault need to be verified via an OTP instead of providing the MasterPassword. This only happens if a user used the `Login with device` on a device which uses either Biometrics login or PIN. These actions prevent the athorizing device to send the MasterPasswordHash. When this happens, the web-vault requests an OTP to be filled-in and this OTP is send to the users email address which is the same as the email address to login. The only way to bypass this is by logging in with the your password, in those cases a password is requested instead of an OTP. In case SMTP is not enabled, it will show an error message telling to user to login using there password. Fixes #4042
2023-10-21New config option disable email changeAdrià Martín
2023-10-05Fix typostuhana
2023-08-13Implement login-with-deviceBernd Schoolmann
2023-07-29Fix .env.template fileBlackDex
There was one item missing and one item wrongly named. This has been fixed including a spellcheck.
2023-06-11feat: Push NotificationsGeekCornerGH
Co-authored-by: samb-devel <[email protected]> Co-authored-by: Zoruk <[email protected]>
2023-04-10Several config and admin interface fixesBlackDex
- Fixed issue with domains starting with `admin` - Fixed issue with DUO not being enabled globally anymore (regression) - Renamed `Ciphers` to `Entries` in overview - Improved `ADMIN_TOKEN` description - Updated jquery-slim and datatables Resolves #3382 Resolves #3415 Resolves discussion on #3288
2023-03-04Admin token Argon2 hashing supportBlackDex
Added support for Argon2 hashing support for the `ADMIN_TOKEN` instead of only supporting a plain text string. The hash must be a PHC string which can be generated via the `argon2` CLI **or** via the also built-in hash command in Vaultwarden. You can simply run `vaultwarden hash` to generate a hash based upon a password the user provides them self. Added a warning during startup and within the admin settings panel is the `ADMIN_TOKEN` is not an Argon2 hash. Within the admin environment a user can ignore that warning and it will not be shown for at least 30 days. After that the warning will appear again unless the `ADMIN_TOKEN` has be converted to an Argon2 hash. I have also tested this on my RaspberryPi 2b and there the `Bitwarden` preset takes almost 4.5 seconds to generate/verify the Argon2 hash. Using the `OWASP` preset it is below 1 second, which I think should be fine for low-graded hardware. If it is needed people could use lower memory settings, but in those cases I even doubt Vaultwarden it self would run. They can always use the `argon2` CLI and generate a faster hash.
2023-02-20Apply rewordingNils Mittler
2023-02-20Make the admin cookie lifetime adjustableNils Mittler
2023-02-12add EXE_SUFFIX to sendmail executable when not specifiedsoruh
2023-02-12check if SENDMAIL_COMMAND is valid using 'which' cratesoruh
2023-02-12Add support for sendmail as a mail transportsoruh
2023-02-12Merge branch 'main' into fix-domain-descriptionDaniel García
2023-02-07remove warn when sanitizing domainBlockListed
2023-02-07fix trailing slash in configuration builderBlockListed
2023-02-07remove documentation of bug since I'm fixing itBlockListed
2023-02-07improve wording of domain descriptionBlockListed
2023-02-06change description of domain configurationBlockListed
Vaultwarden send won't work if the domain includes a trailing slash. This should be documented, as it may lead to confusion amoung users.
2023-01-25working implementationsirux88
2023-01-24Update KDF Configuration and processingBlackDex
- Change default Password Hash KDF Storage from 100_000 to 600_000 iterations - Update Password Hash when the default iteration value is different - Validate password_iterations - Validate client-side KDF to prevent it from being set lower than 100_000
2023-01-09Fix remaning inline formatBlackDex
2023-01-09Resolve uninlined_format_args clippy warningsBlackDex
The upcomming release of Rust 1.67.0 will warn on `uninlined_format_args`. This PR resolves that by inlining all these items. It also looks nicer.
2023-01-09Log message to stderr if LOG_FILE is not writablepjsier
Co-authored-by: Helmut K. C. Tessarek <[email protected]>
2023-01-09Log message to stderr if LOG_FILE is not writablepjsier
Co-authored-by: Helmut K. C. Tessarek <[email protected]>
2023-01-09Resolve uninlined_format_args clippy warningsBlackDex
The upcomming release of Rust 1.67.0 will warn on `uninlined_format_args`. This PR resolves that by inlining all these items. It also looks nicer.
2023-01-09Log message to stderr if LOG_FILE is not writablepjsier
Co-authored-by: Helmut K. C. Tessarek <[email protected]>
2023-01-09Validate YUBICO_SERVER string (#3003)BlackDex
If the `YUBICO_SERVER` is defined to an empty string, the whole yubikey implementation doesn't work anymore. This PR adds a check for this variable that it at least starts with `https://`. Resolves #3003
2023-01-09Removed unsafe-inline JS from CSP and other fixesBlackDex
- Removed `unsafe-inline` for javascript from CSP. The admin interface now uses files instead of inline javascript. - Modified javascript to work not being inline. - Run eslint over javascript and fixed some items. - Added a `to_json` Handlebars helper. Used at the diagnostics page. - Changed `AdminTemplateData` struct to be smaller. The `config` was always added, but only used at one page. Same goes for `can_backup` and `version`. - Also inlined CSS. We can't remove the `unsafe-inline` from css, because that seems to break the web-vault currently. That might need some further checks. But for now the 404 page and all the admin pages are clear of inline scripts and styles.
2023-01-02Optimize config loading messagesBlackDex
As kinda discussed here #3090, the messages regarding loading the configuration files is a bit strange or unclear. There have been some other reports regarding this in the past, but wasn't that big a of a deal. But to make the whole process it bit more nice, this PR adjusts the way it reports issues and some small changes to the messages to make it all a bit more clear. - Do not report a missing `.env` file, but only send a message when using one. - Exit instead of Panic, a panic causes a stacktrace, which isn't needed here. I'm using a exit code 255 here so it is different to the other exit's we use. - Exit on more issues, since if we continue, it could cause configuration issues if the user thinks all is fine. - Use the actual env file used in the messages instead of `.env`. - Added a **INFO** message when loading the `config.json`. This makes it consistent with the info message for loading the env file. Resolves #3090
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 12:11:46 +0000