geforkt von mirrored/vaultwarden
Set "Bypass admin page security" as read-only
It was possible to disable the admin security via the admin interface. This is kinda insecure as mentioned in #2761. This PR set this value as read-only and admin's need to set the correct ENV variable. Currently saved settings which do override this are still valid though. If an admin want's this removed, they either need to reset the config, or change the value in the `config.json` file. Fixes #2761
Dieser Commit ist enthalten in:
Ursprung
7a7673103f
Commit
b141f789f6
1 geänderte Dateien mit 1 neuen und 1 gelöschten Zeilen
|
@ -533,7 +533,7 @@ make_config! {
|
|||
database_conn_init: String, false, def, String::new();
|
||||
|
||||
/// Bypass admin page security (Know the risks!) |> Disables the Admin Token for the admin page so you may use your own auth in-front
|
||||
disable_admin_token: bool, true, def, false;
|
||||
disable_admin_token: bool, false, def, false;
|
||||
|
||||
/// Allowed iframe ancestors (Know the risks!) |> Allows other domains to embed the web vault into an iframe, useful for embedding into secure intranets
|
||||
allowed_iframe_ancestors: String, true, def, String::new();
|
||||
|
|
Laden …
In neuem Issue referenzieren