nickslowinski/vaultwarden-test
1
0
Fork 0
geforkt von mirrored/vaultwarden
Code Pull-Requests Aktivität
2171 Commits 1 Branch 49 Tags 23 MiB
Commit-Graph

717 Commits

Autor SHA1 Nachricht Datum
Jeremy Lin
455a23361f Clean up datetime output and code 
* For clarity, add `UTC` suffix for datetimes in the `Diagnostics` admin tab.
* Format datetimes in the local timezone in the `Users` admin tab.
* Refactor some datetime code and add doc comments.
 2020-12-13 19:49:22 -08:00
BlackDex
1a8ec04733 Small update on favicon downloading 
- Changed the user-agent, which caused at least one site to stall the
  connection (Same happens on icons.bitwarden.com)
- Added default_header creation to the lazy static CLIENT
- Added referer passing, which is checked by some sites
- Some small other changes
 2020-12-10 23:13:24 +01:00
Jeremy Lin
4e60df7a08 Fix stale data check failure when cloning a cipher 2020-12-10 00:17:34 -08:00
BlackDex
48baf723a4 Updated icon downloading 
- Added more checks to prevent panics (Removed unwrap)
- Try do download from base domain or add www when the provided domain
  fails
- Added some more domain validation checks to prevent errors
- Added the ICON_BLACKLIST_REGEX to a Lazy Static HashMap which
  speeds-up the checks!
- Validate the Regex before starting/config change.
- Some cleanups
- Disabled some noisy debugging from 2 crates.
 2020-12-08 17:34:18 +01:00
Daniel García
d15d24f4ff
Merge pull request #1242 from BlackDex/allow-manager-role 
Adding Manager Role support
 2020-12-08 16:11:55 +01:00
Daniel García
8d992d637e
Merge pull request #1257 from jjlin/cipher-rev-date 
Validate cipher updates with revision date
 2020-12-08 15:59:21 +01:00
Daniel García
b32f4451ee
Merge branch 'master' into admin-disable-user 2020-12-08 15:42:37 +01:00
Jeremy Lin
a9e9a397d8 Validate cipher updates with revision date 
Prevent clients from updating a cipher if the local copy is stale.
Validation is only performed when the client provides its last known
revision date; this date isn't provided when using older clients,
or when the operation doesn't involve updating an existing cipher.

Upstream PR: https://github.com/bitwarden/server/pull/994
 2020-12-07 19:34:00 -08:00
janost
1eb5495802 Show latest active device as last active on admin page 2020-12-03 17:07:32 +01:00
BlackDex
7cf8809d77 Adding Manager Role support 
This has been requested a few times (#1136 & #246 & forum), and there already were two
(1:1 duplicate) PR's (#1222 & #1223) which needed some changes and no
followups or further comments unfortunally.

This PR adds two auth headers.
- ManagerHeaders
  Checks if the user-type is Manager or higher and if the manager is
part of that collection or not.
- ManagerHeadersLoose
  Check if the user-type is Manager or higher, but does not check if the
user is part of the collection, needed for a few features like
retreiving all the users of an org.

I think this is the safest way to implement this instead of having to
check this within every function which needs this manually.

Also some extra checks if a manager has access to all collections or
just a selection.

fixes #1136
 2020-12-02 22:50:51 +01:00
janost
043aa27aa3 Implement admin ability to enable/disable users 2020-11-30 23:12:56 +01:00
James Hurst
771233176f Fix for negcached icons 2020-11-09 22:06:11 -05:00
James Hurst
ed70b07d81 Return 404 instead of fallback icon 2020-11-09 20:47:26 -05:00
Jeremy Lin
95caaf2a40 Add missing admin endpoints for deleting ciphers 
This fixes the inability to bulk-delete ciphers from org vault views.
 2020-10-23 03:42:22 -07:00
Fabian van Steen
b41a0d840c
Correction of verify_email error message 2020-10-23 10:30:25 +02:00
BlackDex
c64560016e Add /api/accounts/verify-password endpoint 
If for some reason the hashed password is cleared from memory within a
bitwarden client it will try to verify the password at the server side.

This endpoint was missing.

Resolves #1156
 2020-09-25 18:26:48 +02:00
BlackDex
6a291040bd As requested here: https://bitwardenrs.discourse.group/t/searchable-user-list-on-admin-panel/299 
- Changed the table layout a bit.
- Added functions to the tables:
  + Search
  + Sort
  + Paginate
 2020-09-19 22:19:55 +02:00
BlackDex
9a47821642 Fixed creating a new organization 
- The new web-vault needs a new api endpoint.
- Added this new endpoint.

Fixes #1139
 2020-09-14 08:34:17 +02:00
Daniel García
a0d92a167c
Merge pull request #1125 from jjlin/org-cipher-visibility 
Hide ciphers from non-selected collections for org owners/admins
 2020-09-10 23:19:14 +02:00
Jeremy Lin
4c3b328aca Hide ciphers from non-selected collections for org owners/admins 
If org owners/admins set their org access to only include selected
collections, then ciphers from non-selected collections shouldn't
appear in "My Vault". This matches the upstream behavior.
 2020-09-01 02:20:25 -07:00
aaxdev
260ffee093 Improving code 2020-08-31 22:20:21 +02:00
aaxdev
c59cfe3371 Fix MsgPack headers and support mobile SignalR 2020-08-31 19:05:07 +02:00
Daniel García
0822c0c128
Update admin page dependencies 2020-08-31 16:40:21 +02:00
Daniel García
0365b7c6a4
Add support for multiple simultaneous database features by using macros. 
Diesel requires the following changes:
- Separate connection and pool types per connection, the generate_connections! macro generates an enum with a variant per db type
- Separate migrations and schemas, these were always imported as one type depending on db feature, now they are all imported under different module names
- Separate model objects per connection, the db_object! macro generates one object for each connection with the diesel macros, a generic object, and methods to convert between the connection-specific and the generic ones
- Separate connection queries, the db_run! macro allows writing only one that gets compiled for all databases or multiple ones
 2020-08-24 20:11:17 +02:00
Jeremy Lin
f83a8a36d1 Track favorites on a per-user basis 
Currently, favorites are tracked at the cipher level. For org-owned ciphers,
this means that if one user sets it as a favorite, it automatically becomes a
favorite for all other users that the cipher has been shared with.
 2020-08-19 02:32:58 -07:00
Daniel García
6a972e4b19
Make the admin URL redirect try to use the referrer first, and use /admin when DOMAIN is not configured and the referrer check doesn't work, to allow users without DOMAIN configured to use the admin page correctly 2020-08-12 19:07:52 +02:00
Daniel García
29c6b145ca
Remove redundant user fetching from login 2020-08-11 16:48:15 +02:00
Jeremy Lin
570d6c8bf9 Add support for restricting org creation to certain users 2020-08-05 22:35:29 -07:00
Daniel García
ad48e9ed0f
Fix unlock on desktop clients 2020-08-04 15:12:04 +02:00
Jeremy Lin
a846f6c610 Fix soft delete notifications 
A soft-deleted entry should now show up in the trash folder immediately
(previously, an extra sync was required).
 2020-07-26 16:19:47 -07:00
Daniel García
32cfaab5ee
Updated dependencies and changed rocket request imports 2020-07-23 21:07:04 +02:00
Daniel García
1e950c7dbc
Replace IP support in preparation for compiling on stable, included some tests to check that the code matches the unstable implementation 2020-07-15 00:00:03 +02:00
Daniel García
f14e19a3d8
Don't compile the regexes each time 2020-07-14 21:58:27 +02:00
Daniel García
668d5c23dc
Removed try_trait and some formatting, particularly around imports 2020-07-14 18:34:22 +02:00
Jeremy Lin
a28ebcb401 Use local time in email notifications for new device logins 
In this implementation, the `TZ` environment variable must be set
in order for the formatted output to use a more user-friendly
time zone abbreviation (e.g., `UTC`). Otherwise, the output uses
the time zone's UTC offset (e.g., `+00:00`).
 2020-07-07 21:30:18 -07:00
Jeremy Lin
979d010dc2 Add support for hiding passwords in a collection 
Ref: https://github.com/bitwarden/server/pull/743
 2020-07-02 21:51:20 -07:00
BlackDex
24c914799d Fixes #1022 cloning with attachments 
When a cipher has one or more attachments it wasn't able to be cloned.
This commit fixes that issue.
 2020-06-07 17:57:04 +02:00
BlackDex
ac2723f898 Updated Organizations overview 
- Changed HTML to match users overview
- Added User count
- Added Org cipher amount
- Added Attachment count and size
 2020-06-03 20:37:31 +02:00
BlackDex
2fffaec226 Added attachment info per user and some layout fix 
- Added the amount and size of the attachments per user
- Changed the items count function a bit
- Some small layout changes
 2020-06-03 17:57:03 +02:00
BlackDex
5c54dfee3a Fixed an issue when DNS resolving fails. 
In the event of a failed DNS Resolving checking for new versions will
cause a huge delay, and in the end a timeout when loading the page.

- Check if DNS resolving failed, if that is the case, do not check for
  new versions
- Changed `fn get_github_api` to make use of structs
- Added a timeout of 10 seconds for the version check requests
- Moved the "Unknown" lables to the "Latest" lable
 2020-06-03 17:07:32 +02:00
Jeremy Lin
39d1a09704 Avoid double-slashes in the admin URL 2020-05-30 01:06:40 -07:00
BlackDex
b6fde857a7 Added version check to diagnostics 
- Added a version check based upon the github api information.
 2020-05-28 20:25:25 +02:00
BlackDex
3c66deb5cc Redesign of the admin interface. 
Main changes:
 - Splitted up settings and users into two separate pages.
 - Added verified shield when the e-mail address has been verified.
 - Added the amount of personal items in the database to the users overview.
 - Added Organizations and Diagnostics pages.
   - Shows if DNS resolving works.
   - Shows if there is a posible time drift.
   - Shows current versions of server and web-vault.
 - Optimized logo-gray.png using optipng

Items which can be added later:
 - Amount of cipher items accessible for a user, not only his personal items.
 - Amount of users per Org
 - Version update check in the diagnostics overview.
 - Copy/Pasteable runtime config which has sensitive data changed or removed for support questions either on the forum or github issues.
 - Option to delete Orgs and all its passwords (when there are no members anymore).
 - Etc....
 2020-05-28 10:46:25 +02:00
Jeremy Lin
a314933557 Allow email changes for existing accounts even when signups are disabled 2020-05-24 14:38:19 -07:00
Daniel García
0807783388
Add ip on totp miss 2020-05-14 00:19:50 +02:00
Daniel García
aee1ea032b
Merge pull request #989 from theycallmesteve/update_responses 
Update responses
 2020-05-13 22:34:16 +02:00
theycallmesteve
5571a5d8ed
Update post_keys to return a keys response model 2020-05-08 13:38:49 -04:00
theycallmesteve
6a8c65493f
Rename collection_user_details to collection_read_only to reflect the response model 2020-05-08 13:37:40 -04:00
theycallmesteve
dfdf4473ea
Rename to_json_list to to_json_provder to reflect the response model 2020-05-08 13:36:35 -04:00
theycallmesteve
632f4d5453
Whitespace fixes 2020-05-07 18:02:37 -04:00
Daniel García
ec8028aef2
Merge pull request #979 from jjlin/admin-redirect 
Use absolute URIs for admin page redirects
 2020-05-03 22:27:09 +02:00
Daniel García
9cca64003a
Remove unused dependency and simple feature, update dependencies and fix some clippy lints 2020-05-03 17:24:51 +02:00
Jeremy Lin
819d5e2dc8 Use absolute URIs for admin page redirects 
This is technically required per RFC 2616 (HTTP/1.1); some proxies will
rewrite a plain `/admin` path to an unexpected URL otherwise.
 2020-05-01 00:31:47 -07:00
Daniel García
0de52c6c99
Merge pull request #957 from jjlin/domain-whitelist 
Domain whitelist cleanup and fixes
 2020-04-18 12:08:48 +02:00
Daniel García
e3b00b59a7
Initial support for soft deletes 2020-04-17 22:35:27 +02:00
Jeremy Lin
0a68de6c24 Warn on empty ADMIN_TOKEN instead of bailing out 
The admin page will still be disabled.

Fixes #849.
 2020-04-09 20:55:08 -07:00
Jeremy Lin
e4d08836e2 Make org owner invitations respect the email domain whitelist 
This closes a loophole where org owners can invite new users from any domain.
 2020-04-09 01:51:05 -07:00
Jeremy Lin
c2a324e5da Clean up domain whitelist logic 
* Make `SIGNUPS_DOMAINS_WHITELIST` override the `SIGNUPS_ALLOWED` setting.
  Otherwise, a common pitfall is to set `SIGNUPS_DOMAINS_WHITELIST` without
  realizing that `SIGNUPS_ALLOWED=false` must also be set.

* Whitespace is now accepted in `SIGNUPS_DOMAINS_WHITELIST`. That is,
  `foo.com, bar.com` is now equivalent to `foo.com,bar.com`.

* Add validation on `SIGNUPS_DOMAINS_WHITELIST`. For example, `foo.com,`
  is rejected as containing an empty token.
 2020-04-09 01:42:27 -07:00
Jeremy Lin
6cd8512bbd Fix Duo auth failure with non-lowercased email addresses 2020-04-07 20:40:51 -07:00
Jeremy Lin
7407b8326a Fix attachment size limit calculation 
The config values (in KB) need to be converted to bytes when comparing
against total attachment sizes.
 2020-03-31 02:30:28 -07:00
Jeremy Lin
862d401077 Fix WebSocket notifications 
Ignore a missing `id` query param; it's unclear what this ID represents,
but it wasn't being used in the existing bitwarden_rs code, and no longer
seems to be sent in the latest versions of the official clients.
 2020-03-26 19:26:44 -07:00
Jeremy Lin
c06162b22f Handle devicePushToken 
Mobile push isn't currently supported, but this should get rid of spurious
`Detected unexpected parameter during login: devicepushtoken` warnings.
 2020-03-22 15:04:25 -07:00
Daniel García
7a6a3e4160
Set the cargo version and allow changing it during build time with BWRS_VERSION. 
Also renamed GIT_VERSION because that's not the only source anymore.
 2020-03-22 16:13:34 +01:00
Daniel García
94341f9f3f
Fix token error while accepting invite 2020-03-20 10:51:17 +01:00
BlackDex
37b212427c Updated jsonwebtoken 
Updated to the latest version of jsonwebtoken.
Some small code changes to match the new versions.
 2020-03-16 16:38:00 +01:00
Daniel García
2ee07ea1d8
Fix empty data when cloning cipher 2020-03-15 17:26:34 +01:00
BlackDex
1b4b40c95d Updated reqwest to the latest version. 
- Use the blocking client (no async).
- Disabled gzip.
- use_sys_proxy is now default.
 2020-03-14 23:12:45 +01:00
Daniel García
a30d5f4cf9
Fix cloning issues 2020-03-14 14:08:57 +01:00
Daniel García
3fa78e7bb1
Initial version of policies 2020-03-14 13:32:28 +01:00
Daniel García
70f3ab8ec3
Migrate lazy_static to once_cell, less macro magic and slightly faster 2020-03-09 22:04:03 +01:00
BlackDex
5a974c7b94 Added SMTP test button in the admin gui 
- Added a test button for checking the e-mail settings.
- Fixed a bug with the _post JavaScript function:
  A function was overwriten with a variable and errors were not handled
correctly like a 500 for example.
 2020-02-26 16:49:56 +01:00
Daniel García
2f4a9865e1
Use absolute paths in the admin page 2020-02-22 17:49:33 +01:00
Jeremy Lin
29a0795219 Add backend support for alternate base dir (subdir/subpath) hosting 
To use this, include a path in the `DOMAIN` URL, e.g.:

* `DOMAIN=https://example.com/custom-path`
* `DOMAIN=https://example.com/multiple/levels/are/ok`
 2020-02-18 21:27:00 -08:00
Daniel García
325039c316
Attachment size limits, per-user and per-organization 2020-02-17 22:56:26 +01:00
Miroslav Prasil
0a72c4b6db Do not disable invitations via admin API 
This was brought up today:

https://github.com/dani-garcia/bitwarden_rs/issues/752#issuecomment-586715073

I don't think it makes much sense in checking whether admin has the
right to send invitation as admin can change the setting anyway.

Removing the condition allows users to forbid regular users from
inviting new users to server while still preserving the option to do so
via the admin API.
 2020-02-16 15:01:07 +00:00
Daniel García
8867626de8
Add option to change invitation org name, fixes #825 
Add option to allow additional iframe ancestors, fixes #843
Sort the rocket routes before printing them
 2020-02-04 22:14:50 +01:00
Daniel García
f5916ec396
Fix backwards indices 2020-01-30 22:33:50 +01:00
Daniel García
ebb36235a7
Cache icons in the clients 2020-01-30 22:30:57 +01:00
Daniel García
def174a517
Convert email domains to punycode 2020-01-30 22:11:53 +01:00
Daniel García
84ed185579
Update u2f to 0.2, which requires OpenSSL but also might solve the problems we've had with certificates. 
The rust image doesn't need installing curl or tar, so removed. Also collapsed ENV lines.
 2020-01-19 21:34:13 +01:00
Daniel García
8c229920ad
Protect websocket server against panics 2020-01-04 23:52:38 +01:00
Daniel García
e274af6e3d
Print current server time when failing TOTP, and use chrono as the rest of the server 2019-12-27 18:42:14 +01:00
Daniel García
a0ece3754b
Formatting 2019-12-27 18:37:14 +01:00
Daniel García
2545469713
Fix crash when page URL points to huge file 2019-12-19 00:37:16 +01:00
Daniel García
5cabf4d040
Fix IP not shown when failed login (Fixes #761) 2019-12-07 14:38:32 +01:00
Daniel García
8d1b72b951
Collapsed log messages from 3 lines per request to 2 and hidden the ones valued as less informative. 
Use LOG_LEVEL debug or trace to recover them.

Removed LOG_MOUNTS and bundled it with LOG_LEVEL debug and trace.

Removed duplicate error messages

Made websocket not proxied message more prominent, but only print it once.
 2019-12-06 22:46:12 +01:00
Daniel García
912e1f93b7
Fix some lints 2019-12-06 22:12:41 +01:00
Daniel García
adc443ea80
Add endpoint to delete specific U2F key 2019-12-01 21:41:46 +01:00
Daniel García
0d32179d07
Logout button in admin page 2019-12-01 21:15:14 +01:00
Daniel García
12928b832c
Fix broken tests 2019-11-30 23:30:35 +01:00
Daniel García
924ba153aa
Merge pull request #730 from tomuta/email_verification 
Implement change-email, email-verification, account-recovery, and welcome notifications
 2019-11-25 08:21:18 +01:00
tomuta
bd1e8be328 Implement change-email, email-verification, account-recovery, and welcome notifications 2019-11-24 22:28:49 -07:00
BlackDex
b209c1bc4d Add an option to fetch and parse href="data:image" 
Some sites are using base64 encoded inline images for favicons.
This will try to match those with some sane checks and return that.
These icons will have lower prio then the icons with a normal URL.
 2019-11-22 13:16:12 +01:00
tomuta
64d6f72e6c Add the ability to disable signups, but allow signups from a whitelist 
This feature can be enabled by setting SIGNUPS_ALLOWED=false and
providing a comma-separated list of whitelisted domains in
SIGNUPS_DOMAINS_WHITELIST.

Fixes #727
 2019-11-16 15:01:45 -07:00
BlackDex
3f6809bcdf Fixed issue/request #705 
Added a config option to disable time drifted totp codes.
Default is false, since this is what the RFC recommends.
 2019-11-07 17:11:29 +01:00
BlackDex
2ffc3eac4d Clippy fix 2019-11-06 20:34:52 +01:00
BlackDex
0ff7fd939e Next attempt for issue #709 fix 
Now creates icon cache directory at startup.
And it also creates the directory if it went missing during runtime.
Also modified the icon_save/mark_negcache to be one.
 2019-11-06 20:21:47 +01:00
BlackDex
ca7c5129b2 Fixed issue #709 creating icon_cache directory. 
When the icon_cache directory doesn't exists yet, and the first icon
catched is a miss this .miss file was not able to be created since the
directory was only created during a valid icon download.
 2019-11-06 15:47:56 +01:00
Patrick Li
85dbf4e16c
Don't include excluded global equivalent domains during sync 
Fixes #681
 2019-11-05 21:29:04 +13:00
Daniel García
e449912f05
Generate recovery codes for email and duo 2019-11-02 18:31:50 +01:00
Daniel García
d29b6bee28
Remove unnecessary clones and other clippy fixes 2019-11-02 17:39:01 +01:00
Miro Prasil
00a11b1b78 Stop leaking usernames when SIGNUPS_ALLOWED=false 
This fixes #691 - respond in less specific way to not leak the
fact that user is already registered on the server.
 2019-11-01 22:34:42 +00:00
BlackDex
ee550be80c Added http favicon url when response failed 2019-10-29 14:24:01 +01:00
Jellyfrog
ebc47dc161
Remove unneeded WS logging 2019-10-17 17:15:11 +02:00
vpl
2edecf34ff Use user_uuid instead of mut twofactor 2019-10-15 21:20:19 +02:00
vpl
18bc8331f9 Send email when preparing 2FA JsonError 2019-10-15 21:19:49 +02:00
BlackDex
603a964579 Fixed issue #663. 
During the 2fa activation there is no twofactor record yet.
Changed the layout a bit so that it will generate a new twofactor record
when it does not exists yet. Else it will just update the already
existing record.
 2019-10-14 00:32:44 +02:00
BlackDex
9466f02696 Recoded TOTP time drift validation 2019-10-12 15:28:28 +02:00
BlackDex
d989a19f76 Merge branch 'master' of https://github.com/dani-garcia/bitwarden_rs into totp-timedrift 2019-10-11 11:22:13 +02:00
Daniel García
d292269ea0
Make the blacklist logic be cached 2019-10-10 23:21:22 +02:00
BlackDex
ebf40099f2 Updated authenticator TOTP 
- Added security check for previouse used codes
- Allow TOTP codes with 1 step back and forward when there is a time
drift. This means in total 3 codes could be valid. But only newer codes
then the previouse used codes are excepted after that.
 2019-10-10 17:32:20 +02:00
BlackDex
edc482c8ea Changed HIBP Error message. 
- Moved the manual link to the check to the top.
- Clearified that hibp is a payed service.
- Changed error logo to hibp logo.
 2019-10-08 22:29:12 +02:00
BlackDex
6e5c03cc78 Some modification when no HIBP API Key is set 
- Added an URL with the useraccount for manual check.
- Added support for HTTP(S)_PROXY for hibp.
 2019-10-08 21:39:11 +02:00
Daniel García
e6b763026e
Merge branch 'master' into icon-security 2019-10-05 16:45:36 +02:00
BlackDex
be2916333b Fixed issue #565 
Issue fixed by omitting the cookie header when cookie_str is empty
 2019-10-05 15:45:09 +02:00
BlackDex
9124d8a3fb Updated icon blacklisting. 
- Blacklisting was not effective for redirects and rel href
- Able to blacklist non global IP's like RFC1918, multicast etc...
 2019-10-05 14:48:15 +02:00
Miro Prasil
d6e9af909b Remove the unnecessary check for sqlite 
The binary we use is called `sqlite3` so no need to check for other
name variants as we won't use those anyways.
 2019-10-01 10:40:22 +01:00
Miro Prasil
acdd42935b Add sqlite binary into the docker images 
This is done to enable backup functionality in the admin interface while
we're waiting for the libsqlite-sys 0.17 to bubble up in the upstream
dependencies. Then we can start using `VACUUM INTO`

This also extends the check for the sqlite binary to also try `sqlite3`
as this is the name of the binary in baseimage distributions we use.
 2019-09-30 13:54:06 +01:00
Daniel García
4c07f05b3a
Remove Result<T, E: Debug> in preparation of deprecation as Rocket responder. 
Removed unnecessary returns
 2019-09-17 21:05:56 +02:00
Daniel García
df8114f8be
Updated client kdf iterations to 100000 and fixed some lints 2019-09-05 21:56:12 +02:00
Daniel García
e3404dd322
Use the local scripts instead of cloudflare, remove jquery and update config so disabling a master toggle doesn't remove the values 2019-08-31 17:47:52 +02:00
Daniel García
bfc517ee80
Remove unused warning 2019-08-31 17:26:16 +02:00
Daniel García
4a7d2a1e28
Rename static files endpoint 2019-08-31 17:25:31 +02:00
vpl
5d50b1ee3c Merge remote-tracking branch 'upstream/master' into email-codes 2019-08-26 21:38:45 +02:00
vpl
c99df1c310 Compare token using crypto::ct_eq 2019-08-26 20:26:59 +02:00
vpl
591ae10144 Get token from single u64 2019-08-26 20:26:54 +02:00
Daniel García
026f9da035
Allow removing users two factors 2019-08-21 17:13:06 +02:00
Daniel García
515b87755a
Update HIBP to v3, requires paid API key, fixes #583 2019-08-20 20:07:12 +02:00
vpl
ee7837d022 Add option to require new device emails 2019-08-19 22:14:00 +02:00
Daniel García
07743e490b
Ignore error sending device email 2019-08-18 19:32:26 +02:00
BlackDex
e7b6238f43 Added reqwest proxy support 2019-08-12 17:24:32 +02:00
vpl
ad2225b6e5 Add configuration options for Email 2FA 2019-08-10 22:39:04 +02:00
vpl
5609103a97 Use ring to generate email token 2019-08-06 22:38:08 +02:00
vpl
6d460b44b0 Use saved token for email 2fa codes 2019-08-04 17:21:57 +02:00
vpl
efd8d9f528 Remove some unused imports, unneeded mut variables 2019-08-04 16:56:41 +02:00
vpl
29aedd388e Add email code logic and move two_factor into separate modules 2019-08-04 16:56:41 +02:00
vpl
27e0e41835 Add email authenticator logic 2019-08-04 16:56:39 +02:00
Daniel García
c9c3f07171
Updated dependencies and fixed panic getting icons 2019-07-30 19:42:05 +02:00
vpl
df71f57d86 Move send device email to end of password login 
Send new device email after two factor authentication.
 2019-07-25 21:10:27 +02:00
vpl
60e39a9dd1 Move retrieve/new device from connData to separate function 2019-07-22 12:30:26 +02:00
vpl
bc6a53b847 Add new device email when user logs in 2019-07-22 08:26:24 +02:00
Daniel García
05a1137828
Move backend checks to build.rs to fail fast, and updated dependencies 2019-07-09 17:26:34 +02:00
Daniel García
5710703c50
Make sure the backup option only appears when using sqlite 2019-06-02 00:08:52 +02:00
Daniel García
1322b876e9
Merge pull request #493 from endyman/feature/initial_mysql_support 
Initial support for mysql
 2019-06-01 23:33:06 +02:00
Emil Madsen
e22e290f67 Fix key and type variable names for mysql 2019-05-20 21:24:29 +02:00
TheMardy
ef551f4cc6 Create Backup funcitonality 
Added create backup functionality to the admin panel
 2019-05-03 15:46:29 +02:00
Daniel García
5521a86693
Change path for served images to avoid collision with vault images 2019-05-01 16:19:22 +02:00
Daniel García
3160780549
Merge pull request #401 from TheMardy/master 
Images in Email Templates
 2019-04-30 17:52:10 +02:00
Daniel García
874f5c34bd
Formatting 2019-04-26 22:08:26 +02:00
Daniel García
253faaf023
Use users duo host when required, instead of always using the global one 2019-04-15 13:07:23 +02:00
Daniel García
3d843a6a51
Merge pull request #460 from janost/organization-vault-purge 
Fixed purging organization vault
 2019-04-14 22:30:51 +02:00
janost
03fdf36bf9 Fixed purging organization vault 2019-04-14 22:12:48 +02:00
Daniel García
fdcc32beda
Validate Duo credentials when custom 2019-04-14 22:05:05 +02:00
Daniel García
bf20355c5e
Merge branch 'duo' 2019-04-14 22:02:55 +02:00
Daniel García
2e12114350
Always create the user when inviting from admin panel 2019-04-12 23:44:49 +02:00
ViViDboarder
d3a8a278e6 Add new endpoint for retrieving all users 2019-04-11 11:24:53 -07:00
Daniel García
8d9827c55f
Implement selection between global config and user settings for duo keys. 2019-04-11 18:40:03 +02:00
Daniel García
cad63f9761
Auto generate akey 2019-04-11 16:08:26 +02:00
Daniel García
621f607297
Update dependencies and fix some warnings 2019-04-11 15:40:19 +02:00
Daniel García
754087b990
Add global duo config and document options in .env template 2019-04-07 18:58:15 +02:00
Daniel García
cfbeb56371
Implement user duo, initial version 
TODO:
- At the moment each user needs to configure a DUO application and input the API keys, we need to check if multiple users can register with the same keys correctly and if so we could implement a global setting.
- Sometimes the Duo frame doesn't load correctly, but canceling, reloading the page and logging in again seems to fix it for me.
 2019-04-05 22:09:53 +02:00
Daniel García
4b40cda910
Added domain blacklist regex for icons service and improved valid domain check. 
Reorganized the icons code a bit.
 2019-03-18 22:12:39 +01:00
Daniel García
61515160a7
Allow changing error codes and create an empty error. 
Return 404 instead of 400 when no accounts breached.
 2019-03-14 00:17:36 +01:00
Daniel García
43f9038325
Add option to force resync clients in admin panel 2019-03-07 21:08:33 +01:00
Daniel García
0718a090e1
Trim spaces from admin token during authentication and validate that the admin panel token is not empty 2019-03-07 20:21:50 +01:00
Daniel García
04922f6aa0
Some formatting and dependency updates 2019-03-03 16:11:55 +01:00
Daniel García
7d2bc9e162
Added option to force 2fa at logins and made some changes to two factor code. 
Added newlines to config options to keep them a reasonable length.
 2019-03-03 16:09:15 +01:00
Daniel García
10756b0920
Update dependencies and fix some lints 2019-02-27 17:21:04 +01:00
Дамјан Георгиевски
473f8b8e31 remove some unneeded mutability 2019-02-22 20:25:50 +01:00
Shane Faulkner
8b5b06c3d1 Allow the Admin token to be disabled in the advanced menu 2019-02-20 14:56:08 -06:00
Daniel García
5ee04e31e5
Updated dependencies, removed some unnecessary clones and fixed some lints 2019-02-20 17:54:18 +01:00
TheMardy
84fb6aaddb Set correct MIME type 2019-02-17 01:08:24 +01:00
Daniel García
a744b9437a
Implemented multiple U2f keys, key names, and compromised checks 2019-02-16 23:07:48 +01:00
Daniel García
6027b969f5
Delete old devices when deauthorizing user sessions 2019-02-16 23:06:26 +01:00
Daniel García
93805a5d7b
Fix Yubikeys deleted on error 2019-02-16 21:30:55 +01:00
TheMardy
a79334ea4c Added static email image routes 2019-02-16 03:44:30 +01:00
BlackDex
3b27dbb0aa Added config option for icon download timeout 2019-02-12 21:56:28 +01:00
Daniel García
9636f33fdb
Implement constant time equal check for admin, 2fa recover and 2fa remember tokens 2019-02-11 23:45:55 +01:00
Daniel García
28d1588e73
Show version in admin panel 2019-02-10 16:02:46 +01:00
Daniel García
f3b1a5ff3e
Error when admin panel is disabled 2019-02-10 15:26:19 +01:00
Daniel García
820c8b0dce
Change use of deserialize_with for Option iterator 2019-02-08 19:12:08 +01:00
Daniel García
8b4a6f2a64
Fixed some clippy lints and changed update_uuid_revision to only use one db query 2019-02-08 18:45:07 +01:00
Daniel García
ef63342e20
Add reset user config button 2019-02-06 17:34:32 +01:00
Daniel García
3db815b969
Implemented config form and fixed config priority 2019-02-06 17:34:30 +01:00
Daniel García
ade293cf52
Save config 2019-02-06 17:34:29 +01:00
Daniel García
877408b808
Implement basic config loading and updating. No save to file yet. 2019-02-06 17:34:29 +01:00
Daniel García
86ed75bf7c
Config can now be serialized / deserialized 2019-02-06 17:34:29 +01:00
Daniel García
20d8d800f3
Updated dependencies 2019-02-06 17:34:29 +01:00
Miroslav Prasil
637f655b6f Do not allocate uneccessary Vec 2019-02-05 14:16:07 +00:00
Miroslav Prasil
b3f7394c06 Do not update revision at the end, as we already did that 2019-02-05 14:09:59 +00:00
Miroslav Prasil
1a5ecd4d4a cipher does not need to be mutable 2019-02-05 13:52:30 +00:00
Miroslav Prasil
bd65c4e312 Remove superfluous cipher.save() call 2019-02-05 13:49:30 +00:00
BlackDex
9026cc8d42 Fixed issue when the iconlist is smaller then 5 
When the iconlist was smaller then 5 items, it would cause a panic.
Solved by using .truncate() on the iconlist.
 2019-02-04 17:27:40 +01:00
BlackDex
574b040142 Loop through the iconlist until an icon is found 
Loop for a maximum of 5 times through the iconlist or until a
successful download of an icon.
 2019-02-04 16:59:52 +01:00
BlackDex
c13f115473 Fixed issue #380 
- Created a separate function for parsing the sizes attribute
 - Parsing sizes now with regex
 - Should work with any non-digit separator
 2019-02-04 12:55:39 +01:00
BlackDex
bc461d9baa Some small changes on the iter of the cookies 2019-01-31 17:58:03 +01:00
BlackDex
5016e30cf2 Added cookies to the icon download request. 
Some sites use XSRF Tokens, or other Tokens to verify a subseqense
response. The cookies which are sent during the page request are now
used when downloading the favicon.

A site which uses this is mijn.ing.nl.
 2019-01-31 15:49:58 +01:00
Daniel García
2a60414031
Reuse the client between requests, and use the client when downloading the icons themselves 2019-01-29 21:21:26 +01:00
BlackDex
feb74a5e86 Changed the way to fix the href 
- Using url from reqwest to fix href, this fixes:
   + "//domain.com/icon.png"
   + "relative/path/to/icon.png"
   + "/absolute/path/to/icon.png"
 - Removed fix_href function
 - Some variable changes
 2019-01-29 18:08:23 +01:00
Daniel García
c0e350b734
Disable icon downloads, accept optional query after icon href, format and clippy fixes 2019-01-28 23:58:32 +01:00
Daniel García
bef1183c49
Only send one notification per vault import and purge, improve move ciphers functions 2019-01-28 00:39:14 +01:00
Daniel García
07388d327f
Merge pull request #370 from BlackDex/favicons 
Added better favicon downloader.
 2019-01-27 16:37:47 +01:00
BlackDex
4de16b2d17 Removed unwrap and added ? 2019-01-27 16:25:02 +01:00
BlackDex
da068a43c1 Moved function call to get_icon_url to prevent error bubbeling 2019-01-27 16:03:18 +01:00
BlackDex
9657463717 Added better favicon downloader. 2019-01-27 15:39:19 +01:00
Daniel García
69036cc6a4
Add disabled user badge (no password) and deauthorize button to admin page. 2019-01-26 19:28:54 +01:00
Daniel García
700e084101
Add 2FA icon to admin panel 2019-01-25 18:50:57 +01:00
Daniel García
a1dc47b826
Change config to thread-safe system, needed for a future config panel. 
Improved some two factor methods.
 2019-01-25 18:24:57 +01:00
Daniel García
86de0ca17b
Fix editing users from collections menu 2019-01-25 17:43:51 +01:00
Stephen White
928ad6c1d8 Fix the list of users with access to a collection to display correctly. 
https://github.com/dani-garcia/bitwarden_rs/issues/364
 2019-01-25 14:18:06 +00:00
Daniel García
bfd93e5b13
Show organizations in admin panel, implement reload templates option 2019-01-20 17:43:56 +01:00
Daniel García
a797459560
Implement HIBP check [WIP]. 
Add extra security attributes to admin cookie.
Error handling.
 2019-01-20 15:36:33 +01:00
Daniel García
6cbb683f99
Rename admin templates to match email 2019-01-19 22:59:32 +01:00
Daniel García
92bbb98d48
Created base template 2019-01-19 22:12:52 +01:00
Daniel García
834c847746
Implement admin JWT cookie, separate JWT issuers for each type of token and migrate admin page to handlebars template 2019-01-19 21:41:49 +01:00
Daniel García
e0aec8d373
Use new i64::to_be_bytes and remove byteorder dep 
(https://doc.rust-lang.org/stable/std/primitive.i64.html#method.to_be_bytes)
 2019-01-16 22:14:17 +01:00
Daniel García
1ce2587330
Correct update cipher order: first save cipher, then cipher-folder, then notify 2019-01-16 19:57:49 +01:00
Miroslav Prasil
71a10e0378 Fix sharing the item to organization. 2019-01-16 11:33:43 +00:00
Daniel García
9bf13b7872
Can't return inside multipart closure 2019-01-15 22:00:41 +01:00
Daniel García
d420992f8c
Update some function calls to use ? 2019-01-15 21:47:16 +01:00
Daniel García
c259a0e3e2
Save recovery code when using yubikey and stop repeating headers.user everywhere 2019-01-15 21:38:21 +01:00
Daniel García
432be274ba
Improve org mismatch check, consider different orgs 2019-01-15 17:31:03 +01:00
Daniel García
484bf5b703
Check that the client is not updating an outdated cipher, that should be part of an org now 2019-01-15 16:35:08 +01:00
Daniel García
4bf32af60e
Fix folder notifications, enable template strict mode and add missing option to env template 2019-01-15 15:28:47 +01:00
Daniel García
f571df7367
Revert yubikey feature, not needed anymore 2019-01-12 15:28:41 +01:00
Daniel García
1d7f704754
Send CipherUpdate when adding and deleting attachments 2019-01-11 01:12:54 +01:00
Daniel García
1d034749f7
Fix AArch64 build by disabling yubico 2019-01-10 23:54:01 +01:00
Daniel García
320266606e
Implement put collections 2019-01-08 20:27:28 +01:00
Daniel García
a0a08c4c5a
Include IP in invalid admin token error 2019-01-08 16:17:18 +01:00
Daniel García
4309df8334
Only create invitations when SMTP is disabled, and ignore invitations if we have a token. 
Disallow users from accepting invitation twice
 2019-01-08 15:42:26 +01:00
Daniel García
f1161c65fb
Make sure an invitation is created when reinviting 2019-01-08 14:05:05 +01:00
Daniel García
21b85b78b1
Changed reinvite check and removed obsolete comment 2019-01-07 15:29:57 +01:00
Daniel García
5e37471488
Merge pull request #323 from njfox/invite_accepted_email 
Send email notifications when invitations are accepted/confirmed
 2019-01-06 14:12:24 +01:00
Nick Fox
0a74e79cea
Refactor generate_invite_claims, make org_name and org_id optional 2019-01-05 23:03:49 -05:00
Nick Fox
7db66f73f0
Refactor invited_by_email check 2019-01-05 13:46:45 -05:00
Nick Fox
cec28a85ac
Update admin page to work with new invitation flow 2019-01-04 10:32:51 -05:00
Daniel García
5f49ecd7f3
Updated dependencies to use u2f crate directly, and some style changes 2019-01-04 00:25:38 +01:00
Nick Fox
736c0e62f2
Send emails to inviters/invitees when invites are accepted/confirmed 2019-01-02 22:20:39 -05:00
Daniel García
30e768613b
Start using rustfmt and some style changes to make some lines shorter 2018-12-30 23:34:31 +01:00
Daniel García
adb8052689
Updated Error to implement Display and Debug, instead of using custom methods 2018-12-30 21:43:56 +01:00
Daniel García
acb9d1b3c6
Remove config option for admin email, embdedded admin page, managed IO::Error, and added security and cache headers globally 2018-12-30 21:43:56 +01:00
Daniel García
2bb0b15e04
Implemented better errors for JWT 2018-12-30 21:43:55 +01:00
Daniel García
250a2b340f
Use new Errors in latest changes 2018-12-30 21:43:55 +01:00
Daniel García
b2fc0499f6
Finish invite functionality, and remove virtual organization 2018-12-30 21:40:26 +01:00
Daniel García
6a99849a1e
Implemented proper error handling, now we can do user.save($conn)?; and it works. 
In the future, maybe we can do the same with the `find_by_id` methods that return an Option.
 2018-12-30 21:31:12 +01:00
Daniel García
172f1770cf
Embed the icon in the binary, no need to download when it's not going to change 2018-12-30 21:31:12 +01:00
Daniel García
1b5134dfe2
Fixed delete user when 2FA is enabled, implemented delete user for admin panel, and the front-end part for invite user. Secured admin panel behind a configurable token. 2018-12-30 21:31:11 +01:00
Daniel García
5fecf09631
Initial version of admin panel, list users and reload user list works. No serious auth method yet, password is 'token123' 2018-12-30 21:31:11 +01:00
Nick Fox
f20c4705d9
Refactor invite claims and disallow reinvites to virtual_org 2018-12-30 00:19:01 -05:00
Nick Fox
3142d8d01f
Add more detail to invitation not found error 2018-12-29 23:28:19 -05:00
Nick Fox
84fa5a4ed6
Implement reinvite endpoint 2018-12-29 23:24:38 -05:00
Nick Fox
b0ac640d8b
Use JWT to validate existing user invites 2018-12-23 15:15:44 -05:00
Daniel García
2b24b17609
Merge pull request #295 from njfox/invite_emails 
Add Email Invite Functionality
 2018-12-21 16:04:19 +01:00
Nick Fox
2cd736ab81
Validate JWT if a user registers with SMTP invites enabled 2018-12-20 22:16:41 -05:00
Nick Fox
99256b9b3a
Prefix unused params with underscore 2018-12-20 21:37:03 -05:00
Nick Fox
26bf7bc12f
Use upstream jslib invite/registration workflow 2018-12-18 23:16:03 -05:00
Daniel García
b3ec8f2611
Merge pull request #302 from tycho/icon-cache-ttl 
implement TTLs for icon cache
 2018-12-18 23:34:16 +01:00
Steven Noonan
a55c048a62
icons: implement positive/negative cache TTLs 
Signed-off-by: Steven Noonan <steven@uplinklabs.net>
 2018-12-18 13:33:32 -08:00
Daniel García
149e69414f
Merge pull request #293 from dheimerl/patch-1 
Update web.rs
 2018-12-18 19:00:43 +01:00
dheimerl
9a7d3634d5
Changed frame-ancestors to use 'self' 2018-12-18 10:19:35 -06:00
dheimerl
7f7c936049
Fixed web.rs 2018-12-17 22:59:53 -06:00
Nick Fox
9479108fb7
Remove CONFIG.email_invitations 2018-12-17 17:10:09 -05:00
Nick Fox
042c1072d9
Remove CONFIG.email_invitation option 2018-12-17 17:02:15 -05:00
Daniel García
5a9aab1a32
Implement fromform, and ignore case and underscores, fixes #298 2018-12-16 20:00:16 +01:00
dheimerl
037eb0b790
Update web.rs 
Add frame-ancestors to allow U2F to work in Chrome (and possibly Firefox) extension
 2018-12-15 13:23:07 -06:00
Nick Fox
4910b14d57
Implement email invitations and registration workflow 2018-12-14 21:56:00 -05:00
algebro
e26e2319da Close #264. Usernames and IP addresses are logged on successful authentication 2018-12-11 15:20:06 -05:00
Daniel García
7adc045b80
Updated IP logging to use client_ip, to match old remote behavior. 
Improved error logging, now it won't show a generic error message in some situations.
Removed delete device, which is not needed as it will be overwritten later.
Logged more info when an error occurs saving a device.
Added orgmanager to JWT claims.
 2018-12-09 17:58:38 +01:00
Daniel García
19754c967f
More changes to the push token, and filtered multipart logs 2018-12-07 18:25:18 +01:00
Daniel García
738ad2127b
Fixed some clippy linting issues 2018-12-07 15:01:29 +01:00
Daniel García
cb930a0858
Remove some required values during login, now uses default values 2018-12-07 14:32:40 +01:00
Daniel García
94810c106a
Migrate to rust 2018 edition 2018-12-07 02:05:45 +01:00
Daniel García
2fde4e6933
Implemented proper logging, with support for file logging, timestamp and syslog (this last one is untested) 2018-12-06 20:35:25 +01:00
Daniel García
dc1bb6de20
Update device push token methods to more closely follow the official server response 2018-12-06 16:28:36 +01:00
Daniel García
6364c05789
Fix attachments during key rotation, add individual attachment key 2018-11-27 17:24:12 +01:00
Daniel García
f71f10eac6
Implemented key rotation with the latest vault 2018-11-24 23:00:41 +01:00
Daniel García
f1acc1e05a
Merge branch 'master' into rocket-0.4 2018-11-21 15:35:34 +01:00
Daniel García
3d36ac4601
Remove unwrap in connection_lost 2018-11-21 15:07:18 +01:00
Daniel García
00abd4c853
Add create endpoint, fixes #253, fixes #261 2018-11-19 20:27:49 +01:00
Daniel García
a4550e51ea
Update dependencies and add /ciphers/create 2018-11-19 20:21:02 +01:00
Daniel García
5edbd0e952
Merge branch 'master' into rocket-0.4 
# Conflicts:
#	Cargo.lock
#	Cargo.toml
#	src/api/core/mod.rs
 2018-11-19 19:52:43 +01:00
Stepan Fedorko-Bartos
f344dbaad4 Fixes NFC Response for Mobile Login 2018-11-17 01:25:07 -07:00
Stepan Fedorko-Bartos
aba9c28226 Disable Yubikey 2FA if 0 Keys Provided 2018-11-16 12:07:00 -07:00
Stepan Fedorko-Bartos
82e2b8a8c0 Code style changes 2018-11-16 11:52:01 -07:00
Stepan Fedorko-Bartos
6d735806c0 Ensures Yubico Creds are set when opening Yubikey Modal 2018-11-15 18:58:44 -07:00
Stepan Fedorko-Bartos
2433d39df5 Allows Custom Yubico OTP Server 2018-11-15 18:54:53 -07:00
Stepan Fedorko-Bartos
9e0e4b13c5 Adds Yubikey OTP Support 2018-11-15 18:43:09 -07:00
Daniel García
f84cbeaaf8
Merge branch 'master' into rocket-0.4 
# Conflicts:
#	src/db/models/organization.rs
 2018-11-14 16:14:49 +01:00
Miroslav Prasil
b94f4db52a Fix #242 2018-11-13 15:34:37 +00:00
Miroslav Prasil
66a4c5d48b Implement comparison between i32 and UserOrgType 2018-11-12 17:13:25 +00:00
Daniel García
4638786507
Merge branch 'master' into rocket-0.4 
# Conflicts:
#	src/api/core/mod.rs
 2018-11-09 16:06:24 +01:00
Roman Hargrave
62bc58e145 Clean up after u2f endpoint split 2018-11-09 00:27:43 -06:00
Roman Hargrave
760e0ab805 Initial u2f fix 2018-11-09 00:00:31 -06:00
Daniel García
bc532f54d5
Improve login query parsing 2018-11-01 19:25:10 +01:00
Daniel García
c673370103
Updated bw_rs to Rocket version 0.4-rc1 2018-11-01 19:25:09 +01:00
janost
c32c65d367 Accept PUT and POST on /settings/domains, returns JsonResult, fixes saving Custom Equivalent Domains 2018-10-23 00:32:43 +02:00
janost
daa66b08dc Fix /sync without query string 2018-10-19 00:54:40 +02:00
janost
55fbd8d468 Don't send Domains if excludeDomains=true on /sync 2018-10-17 23:22:07 +02:00
Miroslav Prasil
2e7fa6440b Do not spawn WS thread if it's disabled 2018-10-15 15:08:15 +01:00
Miroslav Prasil
9ecc98c3cc Disable WebSockets negotiation by default 2018-10-14 23:25:16 +01:00