Author	SHA1	Message	Date
Daniel García	814ce9a6ac	Merge pull request #3632 from sirux88/fix-reset-password-check-issue ... fix missing password check while manual reset password enrollment	2023-07-04 20:55:34 +02:00
Daniel García	1bee46f64b	Merge pull request #3623 from fashberg/main ... Added-External_id for Collections	2023-07-04 20:54:36 +02:00
Jan Jansen	84e901b7d2	add user to collection during creation ... Signed-off-by: Jan Jansen <jan.jansen@gdata.de>	2023-07-04 20:27:37 +02:00
Folke Ashberg	839b2bc950	fix format error	2023-07-04 20:26:03 +02:00
Folke Ashberg	6050c8dac5	Added-External_id for Collections	2023-07-04 20:26:03 +02:00
BlackDex	0a6b797e6e	Update crates and small clippy fix ... - Update all crates - Remove async which is reported by clippy in v1.72.0	2023-07-04 20:12:50 +02:00
sirux88	fb6f441a4f	fixed unnecessary variable usage	2023-07-04 18:57:49 +02:00
sirux88	9876aedd67	added password check for manual reset ... password enrollment endpoint	2023-07-04 18:57:49 +02:00
Daniel García	19e671ff25	Fix dataurl parse panic when icon is malformed	2023-07-03 20:20:26 +02:00
Daniel García	60964c07e6	Add some extra access checks for attachments and groups	2023-07-03 19:58:14 +02:00
GeekCornerGH	1074315a87	feat: Support for storing passkeys in the vault	2023-06-22 18:48:13 +02:00
BlackDex	3c0cac623d	Fix send access regression ... In a previous commit push notifications for mobile were added, but this introduced a header guard which caused issues with anonymous endpoints. This PR fixes this by using a uuid with only 0's. Fixes #3607	2023-06-22 16:40:26 +02:00
Jan Jansen	e818a0bf37	Add group import on invite ... Fixes #3599 Signed-off-by: Jan Jansen <jan.jansen@gdata.de>	2023-06-22 11:10:43 +02:00
BlackDex	84a23008f4	Update crates and workflow ... - Updated all the crates - Updated workflow actions - Set cargo registry to sparse	2023-06-21 22:01:05 +02:00
Bernd Schoolmann	e4606431d1	Fix mobile push blocking requests and spamming push server	2023-06-16 23:34:16 +02:00
BlackDex	a05187c0ff	Some code changes and optimizations ... Some cleanups and optimizations done on the code generated by @Kurnihil	2023-06-13 08:51:07 +02:00
BlackDex	8e34495e73	Merge and modify PR from @Kurnihil ... Merging a PR from @Kurnihil into the already rebased branch. Made some small changes to make it work with newer changes. Some finetuning is probably still needed. Co-authored-by: Daniele Andrei <daniele.andrei@geo-satis.com> Co-authored-by: Kurnihil	2023-06-13 08:51:07 +02:00
BlackDex	4219249e11	Add support for Organization token ... This is a WIP for adding organization token login support. It has basic token login and verification support, but that's about it. This branch is a refresh of the previous version, and will contain code from a PR based upon my previous branch.	2023-06-13 08:48:18 +02:00
GeekCornerGH	2d66292350	feat: Push Notifications ... Co-authored-by: samb-devel <125741162+samb-devel@users.noreply.github.com> Co-authored-by: Zoruk <Zoruk@users.noreply.github.com>	2023-06-11 13:28:18 +02:00
BlackDex	83376544d8	Fix collection change ws notifications ... When chaning a collection this did not got notified via WebSockets. This PR adds this feature and resolves #3534	2023-05-26 17:42:00 +02:00
BlackDex	636f16dc66	Prevent 401 on main admin page ... When you are not loggedin, and have no cookie etc.. we always returned a 401. This was mainly to allow the login page on all the sub pages, and after login being redirected to the requested page, for these pages a 401 is a valid response, since, you do not have access. But for the main `/admin` page, it should just respond with a `200` and show the login page. This PR fixes this flow and response. It should prevent people using Fail2ban, or other tools being triggered by only accessing the login page. Resolves #3540	2023-05-25 23:40:36 +02:00
Jeremy Lin	23aa9088f3	Sync global_domains.json to bitwarden/server@8dda73a (Pinterest)	2023-05-17 12:04:31 -07:00
Stefan Melmuk	4d5c047ddc	policy data should be null not an empty object	2023-05-09 11:14:46 +02:00
BlackDex	4a2ed553df	Use Rocket v0.5 branch to fix endpoints ... There now is a `v0.5` branch which will be the final release version when the time is there. Switched to this instead of the `master` branch which contains other fixes and enhancements as well (for `v0.6`). This should solve all the endpoint issue we were having.	2023-05-06 19:46:55 +02:00
BlackDex	f906f6230a	Change String to &str for all Rocket functions ... During setting the latest commit hash for Rocket and updating all the other crates, there were some messages regarding the usage of `String` for the Rocket endpoint function calls. I acted upon this message and changed all `String` types to `&str` and modified the code where needed. This ended up in less alloc calls, and probably also a bit less memory usage. - Updated all the crates and commit hashes - Modified all `String` to `&str` where applicable	2023-04-30 17:18:12 +02:00
BlackDex	951ba55123	Prevent some ::_ logs from outputting	2023-04-30 17:17:43 +02:00
BlackDex	18abf226be	Fix admin post endpoints	2023-04-30 17:09:42 +02:00
Tim Vilgot Mikael Fredenberg	55c1b6e8d5	inline static rsa keys	2023-04-23 21:34:26 +02:00
Daniel García	3d7e80a7aa	Merge pull request #3440 from BlackDex/switch-ws-to-streams ... Small update to Rocket WebSockets	2023-04-17 20:26:03 +02:00
kennymc-c	271e3ae757	Changed permissions back to 644	2023-04-12 18:06:46 +02:00
BlackDex	48cc31a59f	Small update to Rocket WebSockets ... Switched from channels to stream. This is able to use yield, and the code looks a bit nicer this way. Also updated all the crates.	2023-04-12 15:59:05 +02:00
kennymc-c	6a7cee4e7e	Fixed footer to footer_text	2023-04-11 22:00:10 +02:00
kennymc-c	f850dbb310	Fixed some missing footer_text partials and a few inconsistencies between plain text and html email templates	2023-04-11 21:27:38 +02:00
Daniel García	07099df41a	Merge pull request #3436 from BlackDex/fix-admin-base-url ... Several config and admin interface fixes	2023-04-10 21:11:44 +02:00
BlackDex	ae437f70a3	Several config and admin interface fixes ... - Fixed issue with domains starting with `admin` - Fixed issue with DUO not being enabled globally anymore (regression) - Renamed `Ciphers` to `Entries` in overview - Improved `ADMIN_TOKEN` description - Updated jquery-slim and datatables Resolves #3382 Resolves #3415 Resolves discussion on #3288	2023-04-10 20:39:51 +02:00
BlackDex	3d11f4cd16	WebSockets via Rocket's Upgrade connection ... This PR implements a (not yet fully released) new feature of Rocket which allows WebSockets/Upgrade connections. No more need for multiple ports to be opened for Vaultwarden. No explicit need for a reverse proxy to get WebSockets to work (Although I still suggest to use a reverse proxy). - Using a git revision for Rocket, since `rocket_ws` is not yet released. - Updated other crates as well. - Added a connection guard to clear the WS connection from the Users list. Fixes #685 Fixes #2917 Fixes #1424	2023-04-10 16:58:58 +02:00
Stefan Melmuk	89e94b1d91	check if reset policy is enabled	2023-04-06 22:34:05 +02:00
BlackDex	bff54fbfdb	Fix sending out multiple websocket notifications ... For some reason I encountered a strange bug which resulted in sending out multiple websocket notifications for the exact same user. Added a `distinct()` for the query to filter out multiple uuid's.	2023-04-02 15:23:36 +02:00
Daniel García	867c6ba056	Merge pull request #3398 from stefan0xC/dont-expect-kdf-memory-or-parallelism ... always return KdfMemory and KdfParallelism	2023-04-02 15:22:42 +02:00
Daniel García	d1ecf03f44	Merge pull request #3397 from nikolaevn/feature/add-admin-reinvite-endpoint ... support `/users/<uuid>/invite/resend` admin api	2023-04-02 15:21:51 +02:00
Nikolay Nikolaev	aa6f774f65	add check user state	2023-03-31 14:03:37 +03:00
Nikolay Nikolaev	379f885354	add mail check	2023-03-31 13:00:57 +03:00
Stefan Melmuk	39a5f2dbe8	clear kdf memory and parallelism with pbkdf2 ... when changing back from argon2id to PBKDF2 the unused parameters should be set to 0. also fix small bug in _register	2023-03-31 07:31:40 +02:00
Stefan Melmuk	0daaa9b175	always return KdfMemory and KdfParallelism ... the client will ignore the value of theses fields in case of `PBKDF2` (whether they are unset or left from trying out `Argon2id` as KDF). with `Argon2id` those fields should never be `null` but always in a valid state. if they are `null` (how would that even happen?) the client still assumes default values for `Argon2id` (i.e. m=64 and p=4) and if they are set to something else login will fail anyway.	2023-03-31 01:10:28 +02:00
Nikolay Nikolaev	0c085d21ce	fmt	2023-03-30 16:04:35 +03:00
Nikolay Nikolaev	dcaaa430f0	support /users/<uuid>/invite/resend admin api	2023-03-30 15:23:16 +03:00
BlackDex	2cda54ceff	Fix password reset issues ... There was used a wrong macro to produce an error message when mailing the user his password was reset failed. It was using `error!()` which does not return an `Err` and aborts the rest of the code. This resulted in the users password still being resetted, but not being notified. This PR fixes this by using `err!()`. Also, do not set the user object as mutable until it really is needed. Second, when a user was using the new Argon2id KDF with custom values like memory and parallelism, that would have rendered the password incorrect. The endpoint which should return all the data did not returned all the new Argon2id values. Fixes #3388 Co-authored-by: Stefan Melmuk <509385+stefan0xC@users.noreply.github.com>	2023-03-30 09:41:13 +02:00
Jeremy Lin	62cebebd3d	Decode knowndevice X-Request-Email as base64url with no padding ... The clients end up removing the padding characters [1][2]. [1] https://github.com/bitwarden/clients/blob/web-v2023.3.0/libs/common/src/misc/utils.ts#L141-L143 [2] https://github.com/bitwarden/mobile/blob/v2023.3.1/src/Core/Utilities/CoreHelpers.cs#L227-L234	2023-03-27 00:03:54 -07:00
BlackDex	8bcd0ab0c6	Some small fixes and updates ... - Updated workflows to use new checkout version This probably fixes the curl download for hadolint also. - Updated crates including Rocket to the latest rc3 :party: - Applied 2 nightly clippy lints to prevent future clippy issues.	2023-03-25 12:51:42 +01:00
Stefan Melmuk	ed8091a994	don't use assert() in production code ... Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>	2023-03-23 00:26:28 +01:00