octoleo/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2024-12-23 11:29:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'BlackDex-issue-3152'

Browse Source
This commit is contained in:
Daniel García 2023-01-24 19:47:20 +01:00
commit b17e2da2cf
No known key found for this signature in database
GPG Key ID: FC8A7D14C3CD543A
3 changed files with 30 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/api/admin.rs
View File

@ -13,7 +13,7 @@ use rocket::{
}; };
use crate::{ use crate::{
api::{core::log_event, ApiResult, EmptyResult, JsonResult, Notify, NumberOrString, UpdateType}, api::{core::log_event, ApiResult, EmptyResult, JsonResult, Notify, NumberOrString},
auth::{decode_admin, encode_jwt, generate_admin_claims, ClientIp}, auth::{decode_admin, encode_jwt, generate_admin_claims, ClientIp},
config::ConfigBuilder, config::ConfigBuilder,
db::{backup_database, get_sql_server_version, models::*, DbConn, DbConnType}, db::{backup_database, get_sql_server_version, models::*, DbConn, DbConnType},
@ -372,7 +372,7 @@ async fn deauth_user(uuid: String, _token: AdminToken, mut conn: DbConn, nt: Not
let save_result = user.save(&mut conn).await; let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await; nt.send_logout(&user, None).await;
save_result save_result
} }
@ -386,7 +386,7 @@ async fn disable_user(uuid: String, _token: AdminToken, mut conn: DbConn, nt: No
let save_result = user.save(&mut conn).await; let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await; nt.send_logout(&user, None).await;
save_result save_result
} }

22
src/api/core/accounts.rs
View File

@ -323,7 +323,10 @@ async fn post_password(
let save_result = user.save(&mut conn).await; let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await; // Prevent loging out the client where the user requested this endpoint from.
// If you do logout the user it will causes issues at the client side.
// Adding the device uuid will prevent this.
nt.send_logout(&user, Some(headers.device.uuid)).await;
save_result save_result
} }
@ -353,7 +356,7 @@ async fn post_kdf(data: JsonUpcase<ChangeKdfData>, headers: Headers, mut conn: D
user.set_password(&data.NewMasterPasswordHash, &data.Key, None); user.set_password(&data.NewMasterPasswordHash, &data.Key, None);
let save_result = user.save(&mut conn).await; let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await; nt.send_logout(&user, Some(headers.device.uuid)).await;
save_result save_result
} }
@ -391,6 +394,12 @@ async fn post_rotatekey(
err!("Invalid password") err!("Invalid password")
} }
// Validate the import before continuing
// Bitwarden does not process the import if there is one item invalid.
// Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
// TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
Cipher::validate_notes(&data.Ciphers)?;
let user_uuid = &headers.user.uuid; let user_uuid = &headers.user.uuid;
// Update folder data // Update folder data
@ -437,7 +446,10 @@ async fn post_rotatekey(
let save_result = user.save(&mut conn).await; let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await; // Prevent loging out the client where the user requested this endpoint from.
// If you do logout the user it will causes issues at the client side.
// Adding the device uuid will prevent this.
nt.send_logout(&user, Some(headers.device.uuid)).await;
save_result save_result
} }
@ -460,7 +472,7 @@ async fn post_sstamp(
user.reset_security_stamp(); user.reset_security_stamp();
let save_result = user.save(&mut conn).await; let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await; nt.send_logout(&user, None).await;
save_result save_result
} }
@ -563,7 +575,7 @@ async fn post_email(
let save_result = user.save(&mut conn).await; let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await; nt.send_logout(&user, None).await;
save_result save_result
} }

10
src/api/notifications.rs
View File

@ -170,6 +170,16 @@ impl WebSocketUsers {
self.send_update(&user.uuid, &data).await; self.send_update(&user.uuid, &data).await;
} }
pub async fn send_logout(&self, user: &User, acting_device_uuid: Option<String>) {
let data = create_update(
vec![("UserId".into(), user.uuid.clone().into()), ("Date".into(), serialize_date(user.updated_at))],
UpdateType::LogOut,
acting_device_uuid,
);
self.send_update(&user.uuid, &data).await;
}
pub async fn send_folder_update(&self, ut: UpdateType, folder: &Folder, acting_device_uuid: &String) { pub async fn send_folder_update(&self, ut: UpdateType, folder: &Folder, acting_device_uuid: &String) {
let data = create_update( let data = create_update(
vec![ vec![