octoleo/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2024-12-23 03:19:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

improved security, disabling policy usage on

Browse Source 
email-disabled clients and some refactoring
This commit is contained in:
sirux88 2023-02-04 13:29:57 +01:00
parent 26cd5d9643
commit 62dfeb80f2
1 changed files with 68 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
src/api/core/organizations.rs
View File

@ -711,10 +711,6 @@ async fn send_invite(
err!("Only Owners can invite Managers, Admins or Owners")
}
if !CONFIG.mail_enabled() && OrgPolicy::org_is_reset_password_auto_enroll(&org_id, &mut conn).await {
err!("With mailing disabled and auto-enrollment-feature of reset-password-policy enabled it's not possible to invite users");
}
for email in data.Emails.iter() {
let email = email.to_lowercase();
let mut user_org_status = UserOrgStatus::Invited as i32;
@ -729,10 +725,6 @@ async fn send_invite(
}
if !CONFIG.mail_enabled() {
if OrgPolicy::org_is_reset_password_auto_enroll(&org_id, &mut conn).await {
err!("With disabled mailing and enabled auto-enrollment-feature of reset-password-policy it's not possible to invite existing users");
}
let invitation = Invitation::new(&email);
invitation.save(&mut conn).await?;
}
@ -748,10 +740,6 @@ async fn send_invite(
// automatically accept existing users if mail is disabled
if !CONFIG.mail_enabled() && !user.password_hash.is_empty() {
user_org_status = UserOrgStatus::Accepted as i32;
if OrgPolicy::org_is_reset_password_auto_enroll(&org_id, &mut conn).await {
err!("With disabled mailing and enabled auto-enrollment-feature of reset-password-policy it's not possible to invite existing users");
}
}
user
}
@ -1597,17 +1585,8 @@ async fn put_policy(
}
}
// This check is required since invited users automatically get accepted if mailing is not enabled (this seems like a vaultwarden specific feature)
// As a result of this the necessary "/accepted"-endpoint doesn't get hit.
// But this endpoint is required for autoenrollment while invitation.
// Nevertheless reset password is fully fuctiontional in settings without mailing by manual enrollment
if pol_type_enum == OrgPolicyType::ResetPassword && data.enabled && !CONFIG.mail_enabled() {
if let Some(policy_data) = &data.data {
if policy_data["autoEnrollEnabled"].as_bool().unwrap_or(false) {
err!("Autoenroll can't be used since it requires enabled emailing")
}
}
err!("Due to potential security flaws and/or misuse reset password policy is disabled on mail disabled instances")
}
let mut policy = match OrgPolicy::find_by_org_and_type(&org_id, pol_type_enum, &mut conn).await {
@ -2542,55 +2521,37 @@ async fn put_reset_password(
None => err!("Required organization not found"),
};
let policy = match OrgPolicy::find_by_org_and_type(&org.uuid, OrgPolicyType::ResetPassword, &mut conn).await {
Some(p) => p,
None => err!("Policy not found"),
};
if !policy.enabled {
err!("Reset password policy not enabled");
}
let org_user = match UserOrganization::find_by_uuid_and_org(&org_user_id, &org.uuid, &mut conn).await {
Some(user) => user,
None => err!("User to reset isn't member of required organization"),
};
if org_user.reset_password_key.is_none() {
err!("Password reset not or not corretly enrolled");
}
if org_user.status != (UserOrgStatus::Confirmed as i32) {
err!("Organization user must be confirmed for password reset functionality");
}
//Resetting user must be higher/equal to user to reset
let mut reset_allowed = false;
if headers.org_user_type == UserOrgType::Owner {
reset_allowed = true;
}
if headers.org_user_type == UserOrgType::Admin {
reset_allowed = org_user.atype != (UserOrgType::Owner as i32);
}
if !reset_allowed {
err!("No permission to reset this user's password");
}
let mut user = match User::find_by_uuid(&org_user.user_uuid, &mut conn).await {
Some(user) => user,
None => err!("User not found"),
};
check_reset_password_applicable_and_permissions(&org_id, &org_user_id, &headers, &mut conn).await?;
if org_user.reset_password_key.is_none() {
err!("Password reset not or not correctly enrolled");
}
if org_user.status != (UserOrgStatus::Confirmed as i32) {
err!("Organization user must be confirmed for password reset functionality");
}
// Sending email before resetting password to ensure working email configuration and the resulting
// user notification. Also this might add some protection against security flaws and misuse
if let Err(e) = mail::send_admin_reset_password(&user.email.to_lowercase(), &user.name, &org.name).await {
error!("Error sending user reset password email: {:#?}", e);
}
let reset_request = data.into_inner().data;
user.set_password(reset_request.NewMasterPasswordHash.as_str(), Some(reset_request.Key), true, None);
user.save(&mut conn).await?;
nt.send_user_update(UpdateType::LogOut, &user).await;
if CONFIG.mail_enabled() {
mail::send_admin_reset_password(&user.email.to_lowercase(), &user.name, &org.name).await?;
}
nt.send_logout(&user, None).await;
log_event(
EventType::OrganizationUserAdminResetPassword as i32,
@ -2610,7 +2571,7 @@ async fn put_reset_password(
async fn get_reset_password_details(
org_id: String,
org_user_id: String,
_headers: AdminHeaders,
headers: AdminHeaders,
mut conn: DbConn,
) -> JsonResult {
let org = match Organization::find_by_uuid(&org_id, &mut conn).await {
@ -2618,15 +2579,6 @@ async fn get_reset_password_details(
None => err!("Required organization not found"),
};
let policy = match OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::ResetPassword, &mut conn).await {
Some(p) => p,
None => err!("Policy not found"),
};
if !policy.enabled {
err!("Reset password policy not enabled");
}
let org_user = match UserOrganization::find_by_uuid_and_org(&org_user_id, &org_id, &mut conn).await {
Some(user) => user,
None => err!("User to reset isn't member of required organization"),
@ -2637,6 +2589,8 @@ async fn get_reset_password_details(
None => err!("User not found"),
};
check_reset_password_applicable_and_permissions(&org_id, &org_user_id, &headers, &mut conn).await?;
Ok(Json(json!({
"Object": "organizationUserResetPasswordDetails",
"Kdf":user.client_kdf_type,
@ -2647,6 +2601,52 @@ async fn get_reset_password_details(
})))
}
async fn check_reset_password_applicable_and_permissions(
org_id: &str,
org_user_id: &str,
headers: &AdminHeaders,
conn: &mut DbConn,
) -> EmptyResult {
check_reset_password_applicable(org_id, conn).await?;
let target_user = match UserOrganization::find_by_uuid_and_org(org_user_id, org_id, conn).await {
Some(user) => user,
None => err!("Reset target user not found"),
};
// Resetting user must be higher/equal to user to reset
let mut reset_allowed = false;
if headers.org_user_type == UserOrgType::Owner {
reset_allowed = true;
}
if headers.org_user_type == UserOrgType::Admin {
reset_allowed = target_user.atype != (UserOrgType::Owner as i32);
}
if !reset_allowed {
err!("No permission to reset this user's password");
}
Ok(())
}
async fn check_reset_password_applicable(org_id: &str, conn: &mut DbConn) -> EmptyResult {
if !CONFIG.mail_enabled() {
err!("Password reset is not supported on an email-disabled instance.");
}
let policy = match OrgPolicy::find_by_org_and_type(org_id, OrgPolicyType::ResetPassword, conn).await {
Some(p) => p,
None => err!("Policy not found"),
};
if !policy.enabled {
err!("Reset password policy not enabled");
}
Ok(())
}
#[put("/organizations/<org_id>/users/<org_user_id>/reset-password-enrollment", data = "<data>")]
async fn put_reset_password_enrollment(
org_id: String,
@ -2656,20 +2656,13 @@ async fn put_reset_password_enrollment(
mut conn: DbConn,
ip: ClientIp,
) -> EmptyResult {
let policy = match OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::ResetPassword, &mut conn).await {
Some(p) => p,
None => err!("Policy not found"),
};
if !policy.enabled {
err!("Reset password policy not enabled");
}
let mut org_user = match UserOrganization::find_by_user_and_org(&headers.user.uuid, &org_id, &mut conn).await {
Some(u) => u,
None => err!("User to enroll isn't member of required organization"),
};
check_reset_password_applicable(&org_id, &mut conn).await?;
let reset_request = data.into_inner().data;
if reset_request.ResetPasswordKey.is_none()