Author	SHA1	Message	Date
BlackDex	7035700c8d	Add Organizational event logging feature ... This PR adds event/audit logging support for organizations. By default this feature is disabled, since it does log a lot and adds extra database transactions. All events are touched except a few, since we do not support those features (yet), like SSO for example. This feature is tested with multiple clients and all database types. Fixes #229	2022-12-01 22:38:59 +01:00
Stefan Melmuk	0aa33a2cb4	don't use param for passing the redirect info ... revert some changes and also rename catcher to `admin_login` to make its function clearer Co-authored-by: BlackDex <black.dex@gmail.com>	2022-11-28 18:21:30 +01:00
Stefan Melmuk	fa7dbedd5d	redirect to admin login page when forward fails ... currently, if the admin guard fails the user will get a 404 page. and when the session times out after 20 minutes post methods will give the reason "undefined" as a response while generating the support string will fail without any user feedback. this commit changes the error handling on admin pages * by removing the reliance on Rockets forwarding and making the login page an explicit route that can be redirected to from all admin pages * by removing the obsolete and mostly unused Referer struct we can redirect the user back to the requested admin page directley * by providing an error message for json requests the `get_diagnostics_config` and all post methods can return a more comprehensible message and the user can be alerted * the `admin_url()` function can be simplified because rfc2616 has been obsoleted by rfc7231 in 2014 (and also by the recently released rfc9110) which allows relative urls in the Location header. c.f. https://www.rfc-editor.org/rfc/rfc7231#section-7.1.2 and https://www.rfc-editor.org/rfc/rfc9110#section-10.2.2	2022-11-28 16:46:06 +01:00
Daniel García	f3beaea9e9	Merge pull request #2933 from stefan0xC/fix-manager-issue ... allow managers to set groups of a collection	2022-11-27 22:02:10 +01:00
Daniel García	39ae2f1f76	Merge pull request #2928 from karbobc/settings-description ... Update settings description	2022-11-27 22:01:54 +01:00
Daniel García	366b1050ec	Merge pull request #2921 from BlackDex/issue-2909 ... Prevent DNS leak when icon regex is configured	2022-11-27 22:00:54 +01:00
Daniel García	b3aab7a6ad	Merge pull request #2920 from BlackDex/issue-2889 ... Added missing `register` endpoint to `identity`	2022-11-27 22:00:23 +01:00
Daniel García	aa8d050d6b	Merge pull request #2919 from BlackDex/issue-2828 ... Fully remove DuckDuckGo email service.	2022-11-27 21:59:51 +01:00
Daniel García	5200f0e98d	Merge pull request #2918 from BlackDex/issue-2761 ... Set "Bypass admin page security" as read-only	2022-11-27 21:59:39 +01:00
Stefan Melmuk	e27a5be47a	allow managers to set groups of a collection ... fixes #2932	2022-11-23 15:47:45 +01:00
Karbob	56786a18f1	Update settings description ... Update description to `admin login requests`.	2022-11-22 22:12:06 +08:00
BlackDex	0d2399d485	Prevent DNS leak when icon regex is configured ... When a icon blacklist regex was configured to not check for a domain, it still did a DNS lookup first. This could cause a DNS leakage for these regex blocked domains. This PR resolves this issue by first checking the regex, and afterwards the other checks. Fixes #2909	2022-11-14 17:25:44 +01:00
BlackDex	5bfc7cfde3	Added missing register endpoint to identity ... In the upcomming web-vault and other clients they changed the register endpoint from `/api/accounts/register` to `/identity/register`. This PR adds the new endpoint to already be compatible with the new clients. Fixes #2889	2022-11-14 17:22:37 +01:00
BlackDex	723f0cbc1e	Fully remove DuckDuckGo email service. ... The DuckDuckGo email service is not supported for self-hosted servers. This option is already hidden via the latest web-vault. This PR also removes some server side headers. Fixes #2828	2022-11-14 17:19:30 +01:00
BlackDex	b141f789f6	Set "Bypass admin page security" as read-only ... It was possible to disable the admin security via the admin interface. This is kinda insecure as mentioned in #2761. This PR set this value as read-only and admin's need to set the correct ENV variable. Currently saved settings which do override this are still valid though. If an admin want's this removed, they either need to reset the config, or change the value in the `config.json` file. Fixes #2761	2022-11-14 17:18:25 +01:00
Samuel Tardieu	7445ee40f8	Remove get_random_64() ... Its uses are replaced by get_randm_bytes() or encode_random_bytes().	2022-11-13 10:03:06 +01:00
Samuel Tardieu	d0baa23f9a	Use constant size generic parameter for random bytes generation ... All uses of `get_random()` were in the form of: `&get_random(vec![0u8; SIZE])` with `SIZE` being a constant. Building a `Vec` is unnecessary for two reasons. First, it uses a very short-lived dynamic memory allocation. Second, a `Vec` is a resizable object, which is useless in those context when random data have a fixed size and will only be read. `get_random_bytes()` takes a constant as a generic parameter and returns an array with the requested number of random bytes. Stack safety analysis: the random bytes will be allocated on the caller stack for a very short time (until the encoding function has been called on the data). In some cases, the random bytes take less room than the `Vec` did (a `Vec` is 24 bytes on a 64 bit computer). The maximum used size is 180 bytes, which makes it for 0.008% of the default stack size for a Rust thread (2MiB), so this is a non-issue. Also, most of the uses of those random bytes are to encode them using an `Encoding`. The function `crypto::encode_random_bytes()` generates random bytes and encode them with the provided `Encoding`, leading to code deduplication. `generate_id()` has also been converted to use a constant generic parameter as well since the length of the requested String is always a constant.	2022-11-11 11:59:27 +01:00
GeekCorner	05d4788d1d	fix: removed a double space	2022-11-09 22:40:01 +01:00
BlackDex	6f0dea1b56	Add /devices/knowndevice endpoint ... Added a new endpoint which the currently beta client for at least Android v2022.10.1 seems to be calling, and crashes with the response we currently provide Fixes #2890 Fixes #2891 Fixes #2892	2022-11-09 22:40:00 +01:00
BlackDex	439ef44973	Update Rust version, deps and workflow ... - Update Rust to v1.65.0 - Update dependencies - Updated workflow files - Added some extra clippy checks - Fixed some clippy checks	2022-11-09 22:40:00 +01:00
BlackDex	c9ec389b24	Support Org Export for v2022.11 clients ... Since v2022.9.x the org export uses a different endpoint. But, since v2022.11.x this endpoint will return a different format. See: https://github.com/bitwarden/clients/pull/3641 and https://github.com/bitwarden/server/pull/2316 To support both version in the case of users having an older client either web-vault or cli this PR checks the version and responds using the correct format. If no version can be determined it will use the new format as a default.	2022-11-07 17:13:34 +01:00
Jeremy Lin	b59809af46	Sync global_domains.json to bitwarden/server@7c783c9 (Atlassian)	2022-10-26 21:42:37 +02:00
Stefan Melmuk	ed24d51d3e	validate cron expressions on startup	2022-10-26 21:42:36 +02:00
Stefan Melmuk	870f0d0932	validate billing_email on save	2022-10-26 21:42:36 +02:00
Daniel García	8409b31d6b	Update to diesel2	2022-10-23 00:49:23 +02:00
MFijak	21bc3bfd53	group support	2022-10-20 15:31:53 +02:00
Stefan Melmuk	64ae5d4f81	verify email on registration via invite link ... if `SIGNUPS_VERIFY` is enabled new users that have been invited have their onboarding flow interrupted because they have to first verify their mail address before they can join an organization. we can skip the extra verication of the email address when signing up because a valid invitation token already means that the email address is working and we don't allow invited users to signup with a different address. unfortunately, this is not possible with emergency access invitations at the moment as they are handled differently.	2022-10-19 22:44:17 +02:00
Jeremy Lin	0c267d073f	Sync global_domains.json to bitwarden/server@ea300b2 (Amazon)	2022-10-19 12:33:04 -07:00
Stefan Melmuk	23f1f8a576	allow registration without invite link ... if signups are allowed invited users should be able to complete their registration even when they don't have the invite link at hand.	2022-10-19 20:39:14 +02:00
Stefan Melmuk	0e6f6e612a	use static_files() for email attachments ... Apply suggestions from code review Co-authored-by: Mathijs van Veluw <black.dex@gmail.com>	2022-10-19 20:39:13 +02:00
Stefan Melmuk	4d1b860dad	attach images to email ... Set SMTP_EMBED_IMAGES option to false if you don't want to attach images to the mail. NOTE: If you have customized the template files `email_header.hbs` and `email_footer.hbs` you can replace `{url}/vw_static/` to `{img_url}` to support both URL schemes	2022-10-19 20:39:13 +02:00
Stefan Melmuk	6576914e55	fix invitations of new users when mail is disabled ... If you add a new user that has already been Invited to another organization they will be Accepted automatically. This should not be possible because they cannot be Confirmed until they have completed their registration. It is also not necessary because their invitation will be accepted automatically once they register.	2022-10-19 20:39:07 +02:00
BlackDex	f41ba2a60f	Fix master password hint update not working. ... - The Master Password Hint input has changed it's location to the password update form. This PR updates the the code to process this. - Also changed the `ProfileData` struct to exclude `Culture` and `MasterPasswordHint`, since both are not used at all, and when not defined they will also not be allocated. Fixes #2833	2022-10-17 17:23:21 +02:00
Jeremy Lin	46ec11de12	Update CSP for DuckDuckGo email forwarding ... Upstream PR: https://github.com/bitwarden/clients/pull/3630	2022-10-14 17:56:42 +02:00
Jeremy Lin	4283a49e0b	Reformat CSP header for readability	2022-10-14 17:56:42 +02:00
Jeremy Lin	1e32db8c41	Add CreationDate to cipher response JSON ... Upstream PR: https://github.com/bitwarden/server/pull/2142	2022-10-14 17:56:42 +02:00
Stefan Melmuk	2dd5086916	more verbose permission denied error ... be a bit more verbose about why a file could not be created when it is caused by a permission denied error.	2022-10-12 01:31:10 +02:00
Stefan Melmuk	7532072d50	add check if data folder is a directory	2022-10-12 01:26:28 +02:00
Stefan Melmuk	ef4072e4ff	improve spelling of minimum expiration hours check ... Co-authored-by: Helmut K. C. Tessarek <tessarek@evermeet.cx>	2022-10-09 16:21:13 +02:00
Stefan Melmuk	c78d383ed1	make invitation expiration time configurable ... configure the number of hours after which organization invites, emergency access invites, email verification emails and account deletion requests expire (defaults to 5 days or 120 hours and must be atleast 1)	2022-10-09 16:21:13 +02:00
Stefan Melmuk	5b96270874	return "Object" for consistency ... Co-authored-by: Jeremy Lin <jjlin@users.noreply.github.com>	2022-10-09 16:21:12 +02:00
Stefan Melmuk	2c0742387b	return CaptchaBypassToken and register object	2022-10-09 16:21:12 +02:00
Stefan Melmuk	1704d14f29	v2022.9.2 expects a json response when registering	2022-10-09 16:21:12 +02:00
Stefan Melmuk	2d7ffbf378	allow the removal of non-confirmed owners ... ensure user_to_edit and user_to_delete are actually confirmed users, before checking if they are the last owner of an organization.	2022-10-09 16:21:11 +02:00
Stefan Melmuk	475c7b8f16	return more descriptive JWT validation messages	2022-10-09 13:55:22 +02:00
Daniel García	6fa6eb18e8	Remove unused value in config endpoint	2022-09-25 19:22:05 +02:00
BlackDex	da9fd6b7d0	Fix organization vault export ... Since v2022.9.x it seems they changed the export endpoint and way of working. This PR fixes this by adding the export endpoint. Also, it looks like the clients can't handle uppercase first JSON key's. Because of this there now is a function which converts all the key's to lowercase first. I have an issue reported at Bitwarden if this is expected behavior: https://github.com/bitwarden/clients/issues/3606 Fixes #2760 Fixes #2764	2022-09-25 19:04:56 +02:00
BlackDex	9eabcd5cae	Add support for send v2 API endpoints ... This PR adds support for the Send v2 API. It should prevent 404 errors which could cause some issues with some configurations on some reverse proxies. In the long run, we can probably remove the old file upload API, but for now lets leave it there, since Bitwarden also still has this endpoint in the code. Might fixes #2753	2022-09-25 19:04:48 +02:00
Aaron	d6e0d4cbbd	fix: update warning and success case verbiage	2022-09-25 19:04:48 +02:00
Aaron	e5e6db2688	fix: tooltip typo	2022-09-25 19:04:48 +02:00