Author	SHA1	Message	Date
Stefan Melmuk	56cad93e0f	add endpoint to bulk delete collections	2023-03-23 00:26:28 +01:00
Stefan Melmuk	3cf67e0b8d	add endpoint to bulk delete groups	2023-03-23 00:26:26 +01:00
Daniel García	729b563160	Merge pull request #3332 from BlackDex/merge-clientip-with-headers ... Merge ClientIp with Headers.	2023-03-15 22:28:03 +01:00
Jeremy Lin	daaa03d1b3	Add support for /api/devices/knowndevice with HTTP header params ... Upstream PR: https://github.com/bitwarden/server/pull/2682	2023-03-11 12:03:05 -08:00
BlackDex	9e5b94924f	Merge ClientIp with Headers. ... Since we now use the `ClientIp` Guard on a lot more places, it also increases the size of binary, and the macro generated code because of this extra Guard. By merging the `ClientIp` Guard with the several `Header` guards we have it reduces the amount of code generated (including LLVM IR), but also a small speedup in build time. I also spotted some small `json!()` optimizations which also reduced the amount of code generated.	2023-03-11 16:58:32 +01:00
BlackDex	0c0e632bc9	Upd Crates, Rust, MSRV, GHA and remove Backtrace ... - Changed MSRV to v1.65. Discussed this with @dani-garcia, and we will support **N-2**. This is/will be the same as for the `time` crate we use. Also updated the wiki regarding this https://github.com/dani-garcia/vaultwarden/wiki/Building-binary - Removed backtrace crate in favor of `std::backtrace` stable since v1.65 - Updated Rust to v1.67.1 - Updated all the crates - Updated the GHA action versions - Adjusted the GHA MSRV build to extract the MSRV from `Cargo.toml`	2023-03-07 09:17:42 +01:00
Daniel García	a13a5bd1d8	Merge pull request #3315 from BlackDex/issue-3311 ... Fix web-vault Member UI show/edit/save	2023-03-06 21:13:34 +01:00
Daniel García	3b34b429f3	Merge pull request #3307 from jjlin/head-routes ... Add HEAD routes to avoid spurious error messages	2023-03-06 21:12:54 +01:00
BlackDex	10c5476d31	Fix web-vault Member UI show/edit/save ... There was a small bug left in regards to the web-vault v2023.2.0 fixes. This PR fixes the left items. I think all should be addressed now. When editing a User, you were not able to see or edit groups, or see wich collections a user bellonged to. Fixes #3311	2023-03-06 17:07:21 +01:00
Jeremy Lin	d3626eba2a	Add HEAD routes to avoid spurious error messages ... Rocket automatically implements a HEAD route when there's a matching GET route, but relying on this behavior also means a spurious error gets logged due to <https://github.com/SergioBenitez/Rocket/issues/1098>. Add explicit HEAD routes for `/` and `/alive` to prevent uptime monitoring services from generating error messages like `No matching routes for HEAD /`. With these new routes, `HEAD /` only checks that the server can respond over the network, while `HEAD /alive` also checks that the database connection is alive, similar to `GET /alive`.	2023-03-05 09:51:42 -08:00
BlackDex	de157b2654	Admin token Argon2 hashing support ... Added support for Argon2 hashing support for the `ADMIN_TOKEN` instead of only supporting a plain text string. The hash must be a PHC string which can be generated via the `argon2` CLI **or** via the also built-in hash command in Vaultwarden. You can simply run `vaultwarden hash` to generate a hash based upon a password the user provides them self. Added a warning during startup and within the admin settings panel is the `ADMIN_TOKEN` is not an Argon2 hash. Within the admin environment a user can ignore that warning and it will not be shown for at least 30 days. After that the warning will appear again unless the `ADMIN_TOKEN` has be converted to an Argon2 hash. I have also tested this on my RaspberryPi 2b and there the `Bitwarden` preset takes almost 4.5 seconds to generate/verify the Argon2 hash. Using the `OWASP` preset it is below 1 second, which I think should be fine for low-graded hardware. If it is needed people could use lower memory settings, but in those cases I even doubt Vaultwarden it self would run. They can always use the `argon2` CLI and generate a faster hash.	2023-03-04 16:15:30 +01:00
Dylan Pinsonneault	f88b6d961e	Fix confirmation for removing 2FA and deauthing sessions in admin panel	2023-02-28 20:38:33 -05:00
Daniel García	0426051541	Merge pull request #3281 from BlackDex/fix-web-vault-issues ... Fix the web-vault v2023.2.0 API calls	2023-02-28 23:45:59 +01:00
Daniel García	4556f668de	Merge pull request #3288 from BlackDex/admin-interface-updates ... Some Admin Interface updates	2023-02-28 23:43:01 +01:00
BlackDex	f10e6b6ac2	Some Admin Interface updates ... - Updated datatables - Added NTP Time check - Added Collections, Groups and Events count for orgs - Renamed `Items` to `Ciphers` - Some small style updates	2023-02-28 20:43:22 +01:00
BlackDex	7ec00d3850	Fix the web-vault v2023.2.0 API calls ... - Supports the new Collection/Group/User editing UI's - Support `/partial` endpoint for cipher updating to allow folder and favorite update for read-only ciphers. - Prevent `Favorite`, `Folder`, `read-only` and `hide-passwords` from being added to the organizational sync. - Added and corrected some `Object` key's to the output json. Fixes #3279	2023-02-27 16:37:58 +01:00
Jonathan Elias Caicedo	8f8d7418ed	Add confirmation for removing 2FA and deauth sessions in admin panel	2023-02-24 16:24:48 -05:00
Jeremy Lin	61183d001c	Fix vault item display in org vault view ... In the org vault view, the Bitwarden web vault currently tries to fetch the groups for an org regardless of whether it claims to have group support. If this errors out, no vault items are displayed.	2023-02-22 12:17:13 -08:00
Daniel García	dc7951efaf	Add missing collections/details endpoint, based on the existing one	2023-02-21 21:58:37 +01:00
Nils Mittler	0f656b4889	Apply rewording	2023-02-21 21:37:24 +01:00
Nils Mittler	6fa1dc50be	Apply Admin Session Lifetime to JWT	2023-02-21 21:37:24 +01:00
Nils Mittler	2bb41367bc	Make the admin cookie lifetime adjustable	2023-02-21 21:37:24 +01:00
Misterbabou	20d8886bfa	Fix Collection Read Only access for groups ... I messed up with identation sorry it's my first PR Fix Collection Read Only access for groups Fix Collection Read Only access for groups With indentation modification	2023-02-21 21:37:23 +01:00
BlackDex	59ef82b740	Fix Organization delete when groups are configured ... With existing groups configured within an org, deleting that org would fail because of Foreign Key issues. This PR fixes this by making sure the groups get deleted before the org does. Fixes #3247	2023-02-21 21:37:23 +01:00
BlackDex	fc543154c0	Validate all needed fields for client API login ... During the client API login we need to have a `device_identifier`, `device_name` and `device_type`. When these were not provided Vaultwarden would panic. This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.	2023-02-21 21:37:23 +01:00
Nils Mittler	8ae799a771	Add function to fetch user by email address	2023-02-20 16:39:56 +01:00
Daniel García	f92efda0f0	Merge branch 'main' into main	2023-02-12 19:40:04 +01:00
Daniel García	5bcee24f88	Merge branch 'main' into feature/kdf-options	2023-02-12 19:23:14 +01:00
soruh	9e3d7ea44c	add EXE_SUFFIX to sendmail executable when not specified	2023-02-12 18:55:15 +01:00
soruh	8cc6dac893	check if SENDMAIL_COMMAND is valid using 'which' crate	2023-02-12 18:55:15 +01:00
soruh	b7c4316c77	Add support for sendmail as a mail transport	2023-02-12 18:54:59 +01:00
Daniel García	bc49d1f90d	Merge branch 'main' into issue-3166	2023-02-12 18:47:55 +01:00
Daniel García	cef5dd4a46	Merge branch 'main' into allow-editing/unhiding-by-group	2023-02-12 18:46:53 +01:00
Daniel García	6e2c3fc1cc	Merge branch 'main' into icon-blacklist-improvements	2023-02-12 18:43:19 +01:00
Daniel García	af69c83db2	Merge branch 'main' into fix-domain-description	2023-02-12 18:42:49 +01:00
Daniel García	c58aac585b	Merge branch 'main' into fix-post-emergency-access	2023-02-12 18:42:21 +01:00
Daniel García	a20a641de3	Merge branch 'main' into spell-jack_mitigation	2023-02-12 18:39:27 +01:00
Helmut K. C. Tessarek	68bcc7a4b8	add argon2 kdf fields	2023-02-07 13:52:52 -05:00
BlockListed	c04a1352cb	remove warn when sanitizing domain	2023-02-07 18:49:26 +01:00
BlockListed	5d1c11ceba	fix trailing slash in configuration builder	2023-02-07 18:42:36 +01:00
BlockListed	a2aa7c9bc2	Revert "fix trailing slash not being removed from domain" ... This reverts commit 679bc7a59b.	2023-02-07 18:41:24 +01:00
Jan Jansen	b3a351ccb2	allow editing/unhiding by group ... Fixes #2989 Signed-off-by: Jan Jansen <jan.jansen@gdata.de>	2023-02-07 16:20:36 +01:00
BlockListed	679bc7a59b	fix trailing slash not being removed from domain	2023-02-07 13:03:28 +01:00
BlockListed	a72d0b518f	remove documentation of bug since I'm fixing it	2023-02-07 12:48:48 +01:00
Kevin P. Fleming	6741b25907	Ensure that all results from check_domain_blacklist_reason are cached.	2023-02-07 05:54:06 -05:00
Kevin P. Fleming	24b5784f02	Generate distinct log messages for regex vs. IP blacklisting. ... When an icon will not be downloaded due to matching a configured blacklist, ensure that the log message indicates the type of blacklist that was matched.	2023-02-07 05:24:23 -05:00
BlockListed	eb9b481eba	improve wording of domain description	2023-02-07 08:49:05 +01:00
BlockListed	64edc49392	change description of domain configuration ... Vaultwarden send won't work if the domain includes a trailing slash. This should be documented, as it may lead to confusion amoung users.	2023-02-06 23:19:08 +01:00
sirux88	0d1753ac74	completly hide reset password policy ... on email disabled instances	2023-02-05 16:47:23 +01:00
sirux88	a6558f5548	rust lang specific improvements	2023-02-05 16:34:48 +01:00