- Oct 24, 2024
-
-
Mathijs van Veluw authored
- Updated all the crates Including in this update is an update from lettre, which solves an issue with some specific SMTP mail providers.
-
- Oct 20, 2024
-
-
Daniel authored
-
- Oct 19, 2024
-
-
Mathijs van Veluw authored
A possible user disclosure when you invite an user into an organization which already has an account on the same instance. This was because we always returned the user's name. To prevent this, this PR only returns the user's name if the status is accepted or higher, else we will return null. This is the same as Bitwarden does. Resolves a reported issue. Also resolved a new `nightly` reported clippy regarding a regex within a loop.
-
Daniel authored
- in case people want to try out the new extension design
-
- Oct 18, 2024
-
-
Mathijs van Veluw authored
- Fixed collection management to be usable from the Password Manager UI - Checked and brought in-to-sync with upstream several json responses - Fixed a small issue with the `fields` response when it was empty Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Daniel authored
- raise MSRV to 1.80.0 - also update the crates
-
Mathijs van Veluw authored
Ever since we changed to pass the full url as a template value handlebars now html-encodes this. This causes issues with the plain/text mails, but it also could potentially cause issues with the text/html templates. This PR encloses the template values inside triple braces `{{{ }}}` which prevents html-encoding. Since the URL is generated via the `url` crate the values are percent-encoded anyway. Fixes #5097 Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Oct 13, 2024
-
-
Mathijs van Veluw authored
In an oversight i forgot to set the type to a hidden type if converting the int was not possible. This fixes that. Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Mathijs van Veluw authored
It seems the iOS clients are not able to handle the `type` key within the `fields` array when they are of the type string. All other clients seem to handle this just fine though. This PR fixes this by validating it is a number, if this is not the case, try to convert the string to a number, or return the default of `1`. `1` is used as this is the type `hidden` and should prevent accidental data disclosure. Fixes #5069 Possibly Fixes #5016 Possibly Fixes #5002 Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Oct 11, 2024
-
-
Mathijs van Veluw authored
* Fix `--version` from failing without config Since we added the option to show the web-vault version also when running `--version` this causes the config to always be validated. While this is not very bad in general, it could cause the command to quit during the config validation, and not show the version, but also errors. This is probably not very useful for this specific command, unlike the `--backup` for example. To fix this, and preventing the config from being validated, i added an AtomicBool to check if we need to validate the config on first load. This prevents errors, and will just show the Vaultwarden version, and if possible the web-vault version too. Fixes #5046 Signed-off-by:
BlackDex <black.dex@gmail.com> * Adjusted the code bsaed upon review Signed-off-by:
BlackDex <black.dex@gmail.com> --------- Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Mathijs van Veluw authored
* Fix collections not editable by managers Since a newer version of the web-vault we use manager were not able to create sub collections anymore. This was because of some missing details in the response of some json objects. This commit fixes this by using the `to_json_details` instead of the `to_json` Fixes #5066 Fixes #5044 * Update crates and GitHub Actions - Updated all the crates - Updated all the GHA dependencies - Configured the trivy workflow to only run on the main repo and not on forks Also selected a random new scheduled date so it will not run at the same time as all other forks. The two changes should help running this scan every day without failing, and also prevent the same for new or updated forks.
-
- Oct 06, 2024
-
-
Mathijs van Veluw authored
The `unix::signal` was also included during Windows compilations. This of course will not work. Fix this by only including it for `unix` targets. Also changed all other conditional compilation options to use `cfg(unix)` instead of `cfg(not(windows))`. The latter may also include `wasm` for example, or any other future target family. This way we will only match `unix` Fixes #5052
-
- Sep 23, 2024
-
-
Mathijs van Veluw authored
* Add extra linting Added extra linting for some code styles. Also added the Rust Edition 2024 lints. Closes #4974 Signed-off-by:
BlackDex <black.dex@gmail.com> * Adjusted according to comments Signed-off-by:
BlackDex <black.dex@gmail.com> --------- Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Sep 20, 2024
-
-
Daniel García authored
* Avoid keyword collision with gen in Rust 2024 * Include new api/config setting to disable user registration, not yet used by clients * Actually qualify CONFIG
-
Mathijs van Veluw authored
It appears that some password histories have an encrypted value on the `lastUsedDate` Instead of only checking if it is a string, also check if it is a valid RFC Date/Time String. If not, set it also to epoch 0. Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Mathijs van Veluw authored
-
- Sep 19, 2024
-
-
Stefan Melmuk authored
-
- Sep 18, 2024
-
-
Daniel authored
- match Bitwarden behaviour - add a different segment in mails for Device Name
-
Stefan Melmuk authored
-
Mathijs van Veluw authored
It seemed to have been possible to have `null` date values. This PR fixes this by setting the epoch start date if either the date does not exists or is not a string. This should solve sync issues with the new native mobile clients. Fixes https://github.com/dani-garcia/vaultwarden/pull/4932#issuecomment-2357581292 Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Sep 13, 2024
-
-
Stefan Melmuk authored
-
- Sep 10, 2024
-
-
Mathijs van Veluw authored
-
- Sep 09, 2024
-
-
Mathijs van Veluw authored
-
- Sep 07, 2024
-
-
Daniel authored
-
- Sep 01, 2024
-
-
Timshel authored
-
Mathijs van Veluw authored
- Updated the web-vault to fix an issue with personal export. Thanks to @stefan0xC for patching this. Fixes #4875 - Updated crates to there latest version - Updated the GitHub Actions - Updated the xx image to the latest version Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Mathijs van Veluw authored
* Add a CLI feature to backup the SQLite DB Many users request to add the sqlite3 binary to the container image. This isn't really ideal as that might bring in other dependencies and will only bloat the image. There main reason is to create a backup of the database. While there already was a feature within the admin interface to do so (or by using the admin API call), this might not be easy. This PR adds several ways to generate a backup. 1. By calling the Vaultwarden binary with the `backup` command like: - `/vaultwarden backup` - `docker exec -it vaultwarden /vaultwarden backup` 2. By sending the USR1 signal to the running process like: - `kill -s USR1 $(pidof vaultwarden) - `killall -s USR1 vaultwarden) This should help users to more easily create backups of there SQLite database. Also added the Web-Vault version number when using `-v/--version` to the output. Signed-off-by:
BlackDex <black.dex@gmail.com> * Spelling and small adjustments Signed-off-by:
BlackDex <black.dex@gmail.com> --------- Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Aug 30, 2024
-
-
Mathijs van Veluw authored
* Allow enforcing Single Org with pw reset policy Bitwarden only allows the Reset Password policy to be set when the Single Org policy is enabled already. This PR adds a check so that this can be enforced when a config option is enabled. Since Vaultwarden encouraged to use multiple orgs when groups were not available yet we should not enable this by default now. This might be something to do in the future. When enabled, it will prevent the Reset Password policy to be enabled if the Single Org policy is not enabled. It will also prevent the Single Org policy to be disabled if the Reset Password policy is enabled. Fixes #4855 Signed-off-by:
BlackDex <black.dex@gmail.com> * Removed some extra if checks Signed-off-by:
BlackDex <black.dex@gmail.com> --------- Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Aug 27, 2024
-
-
Mathijs van Veluw authored
* Allow Org Master-Pw policy enforcement We didn't returned the master password policy for the user. If the `Require existing members to change their passwords` check was enabled this should trigger the login to show a change password dialog. All the master password policies are merged into one during the login response and it will contain the max values and all `true` values which are set by all the different orgs if a user is an accepted member. Fixes #4507 Signed-off-by:
BlackDex <black.dex@gmail.com> * Use .reduce instead of .fold Signed-off-by:
BlackDex <black.dex@gmail.com> --------- Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Mathijs van Veluw authored
To provide a way to add more security regarding file/folder permissions this PR adds a way to allow setting a custom `UMASK` variable. This allows people to set a more secure default like only allowing the owner the the process/container to read/write files and folders. Examples: - `UMASK=022` File: 644 | Folder: 755 (Default of the containers) This means Owner read/write and group/world read-only - `UMASK=027` File: 640 | Folder: 750 This means Owner read/write, group read-only, world no access - `UMASK=077` File: 600 | Folder: 700 This measn Owner read/write and group/world no access resolves #4571 Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Aug 24, 2024
-
-
Mathijs van Veluw authored
Update the security readme with a new GPG security key and some small other changes. Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Aug 23, 2024
-
-
Mathijs van Veluw authored
- Updated crates - Fixed MSRV to actually be N-2 - Changed some features to use the `dep:` prefix. This is needed for edition-2024 anyway although that will be a while before we can use that. Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Mathijs van Veluw authored
Updated the issue template a bit regarding some remarks in the previous pr. Also made it so that collapsing all items will show all the specific item id's instead of there types. Easy for editiing :). Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Aug 22, 2024
-
-
philomathic_life authored
-
- Aug 21, 2024
-
-
Timshel authored
-
Mathijs van Veluw authored
Fixed an issue with login with device for the new Bitwrden Beta clients. They seem to not support ISO8601 milli date/time, only micro. Also updated the device display names to match Upstream and added the CLI devices which were missing. Signed-off-by:
BlackDex <black.dex@gmail.com>
-
Stefan Melmuk authored
when cloning an item from an organization to the personal vault the client sends the collection id of the cloned item
-
- Aug 20, 2024
-
-
Mathijs van Veluw authored
Updated the issue template to use a form and guide users to provide all information useful to troublshoot issues Als updated links to prefer the usage of GitHub Discussions. Signed-off-by:
BlackDex <black.dex@gmail.com>
-
- Aug 18, 2024
-
-
Mathijs van Veluw authored
Since the change to camelCase variables the error messages in the Vaultwarden Admin were not shown correctly anymore. This PR fixes this by changing the case of the json key's. Also updated the save and delete of the config to provide a more descriptive error instead of only `Io` or which ever other error might occure. Fixes #4834
-
- Aug 17, 2024
-
-
Timshel authored
-