James Hurst
ed70b07d81
Return 404 instead of fallback icon
2020-11-09 20:47:26 -05:00
Ave
fa364c3f2c
Ensure that a user is actually in an org when applying policies
2020-11-08 01:14:17 +03:00
Daniel García
b5f9fe4d3b
Fix #1206
2020-11-07 23:03:02 +01:00
Daniel García
013d4c28b2
Try to fix #1218
2020-11-07 23:01:56 +01:00
Jeremy Lin
95caaf2a40
Add missing admin endpoints for deleting ciphers
...
This fixes the inability to bulk-delete ciphers from org vault views.
2020-10-23 03:42:22 -07:00
Fabian van Steen
b41a0d840c
Correction of verify_email error message
2020-10-23 10:30:25 +02:00
Rob Watson
b9daa59e5d
Add DATABASE_MAX_CONNS config setting
2020-10-09 10:29:02 +02:00
Daniel García
448e6ac917
Invalidate sessions when changing password or kdf values
2020-10-03 22:43:13 +02:00
Daniel García
729c9cff41
Retry initial db connection, with adjustable option
2020-10-03 22:32:00 +02:00
Mathijs van Veluw
c698bca2b9
Merge branch 'master' into mariadb-fk-issues
2020-09-25 22:25:57 +02:00
BlackDex
c64560016e
Add /api/accounts/verify-password endpoint
...
If for some reason the hashed password is cleared from memory within a
bitwarden client it will try to verify the password at the server side.
This endpoint was missing.
Resolves #1156
2020-09-25 18:26:48 +02:00
BlackDex
978be0b4a9
Fixed foreign-key (mariadb) errors.
...
When using MariaDB v10.5+ Foreign-Key errors were popping up because of
some changes in that version. To mitigate this on MariaDB and other
MySQL forks those errors are now catched, and instead of a replace_into
an update will happen. I have tested this as thorough as possible with
MariaDB 10.5, 10.4, 10.3 and the default MySQL on Ubuntu Focal. And
tested it again using sqlite, all seems to be ok on all tables.
resolves #1081 . resolves #1065 , resolves #1050
2020-09-22 12:13:02 +02:00
Daniel García
2f3e18caa9
Merge pull request #1146 from BlackDex/user-orgs-table-enhancement
...
Enhanced user and orgs tables in admin view.
2020-09-20 16:48:19 +02:00
BlackDex
6a291040bd
As requested here: https://bitwardenrs.discourse.group/t/searchable-user-list-on-admin-panel/299
...
- Changed the table layout a bit.
- Added functions to the tables:
+ Search
+ Sort
+ Paginate
2020-09-19 22:19:55 +02:00
BlackDex
f847c6e225
Updated the config options descriptions.
...
Made some small changes to the description of the config options for
SMTP. Some were a bit cryptic and missing some extra descriptions.
Also made it more clear which type of secured smtp connection is going
to used.
2020-09-19 17:09:58 +02:00
Daniel García
99da5fbebb
Merge pull request #1143 from BlackDex/better-lettre-errors
...
Format some common Lettre errors a bit simpler
2020-09-14 22:18:47 +02:00
BlackDex
6a0d024c69
Format some common Lettre errors a bit simpler
...
Currently when for example using the admin interface to send out a test e-mail just
returns `SmtpError`. This is not very helpful. What i have done.
- Match some common Lettre errors to return the error message.
- Other errors will just be passed on as before.
Some small other changes:
- Fixed a clippy warning about using clone().
- Fixed a typo where Lettere was spelled with one t.
2020-09-14 20:47:46 +02:00
BlackDex
9a47821642
Fixed creating a new organization
...
- The new web-vault needs a new api endpoint.
- Added this new endpoint.
Fixes #1139
2020-09-14 08:34:17 +02:00
Daniel García
d69968313b
Merge pull request #1140 from jjlin/UserOrgType-cmp
...
Simplify implementation of `UserOrgType::cmp()`
2020-09-13 15:10:54 +02:00
Daniel García
3c377d97dc
Merge pull request #1137 from BlackDex/smtp-multi-auth-mechanism
...
Allow multiple SMTP Auth meganisms.
2020-09-13 15:09:58 +02:00
Jeremy Lin
0eee907c88
Simplify implementation of UserOrgType::cmp()
...
Also move `UserOrgType::from_str()` closer to the definition of `UserOrgType`
since it references specific enum values.
2020-09-13 02:03:16 -07:00
BlackDex
c877583979
Allow multiple SMTP Auth meganisms.
...
- Allow all SMTP Auth meganisms supported by Lettre.
- The config value order is leading and values can be separated by a
comma ','
- Case doesn't matter, and invalid values are ignored.
- Warning is printed when no valid value is found at all.
2020-09-12 21:47:24 +02:00
BlackDex
844cf70345
Updated lettre (and other crates) and workflow.
...
General:
- Updated several dependancies
Lettre:
- Updateded lettere and the workflow
- Changed encoding to base64
- Convert unix newlines to dos newlines for e-mails.
- Created custom e-mail boundary (auto generated could cause errors)
Tested the e-mails sent using several clients (Linux, Windows, MacOS, Web).
Run msglint (https://tools.ietf.org/tools/msglint/ ) on the generated e-mails until all errors were gone.
Lettre has changed quite some stuff compared between alpha.1 and alpha.2, i haven't noticed any issues sending e-mails during my tests.
2020-09-11 23:52:20 +02:00
Daniel García
a0d92a167c
Merge pull request #1125 from jjlin/org-cipher-visibility
...
Hide ciphers from non-selected collections for org owners/admins
2020-09-10 23:19:14 +02:00
Jeremy Lin
4c3b328aca
Hide ciphers from non-selected collections for org owners/admins
...
If org owners/admins set their org access to only include selected
collections, then ciphers from non-selected collections shouldn't
appear in "My Vault". This matches the upstream behavior.
2020-09-01 02:20:25 -07:00
aaxdev
260ffee093
Improving code
2020-08-31 22:20:21 +02:00
aaxdev
c59cfe3371
Fix MsgPack headers and support mobile SignalR
2020-08-31 19:05:07 +02:00
Daniel García
0822c0c128
Update admin page dependencies
2020-08-31 16:40:21 +02:00
Daniel García
aaba1e8368
Fix some clippy warnings and remove unused function
2020-08-28 22:10:28 +02:00
Jeremy Lin
175d647e47
Delete associated favorites when deleting a cipher or user
...
This prevents foreign key constraint violations.
2020-08-26 01:27:38 -07:00
Daniel García
0365b7c6a4
Add support for multiple simultaneous database features by using macros.
...
Diesel requires the following changes:
- Separate connection and pool types per connection, the generate_connections! macro generates an enum with a variant per db type
- Separate migrations and schemas, these were always imported as one type depending on db feature, now they are all imported under different module names
- Separate model objects per connection, the db_object! macro generates one object for each connection with the diesel macros, a generic object, and methods to convert between the connection-specific and the generic ones
- Separate connection queries, the db_run! macro allows writing only one that gets compiled for all databases or multiple ones
2020-08-24 20:11:17 +02:00
Daniel García
19889187a5
Merge pull request #1106 from jjlin/favorites
...
Track favorites on a per-user basis
2020-08-24 00:31:48 +02:00
Daniel García
9571277c44
Merge pull request #1112 from jjlin/token-size-docs
...
Add more docs on the `email_token_size` setting
2020-08-24 00:25:47 +02:00
Daniel García
a202da9e23
Merge pull request #1099 from jjlin/global-domains
...
Sync global_domains.json with upstream
2020-08-24 00:25:33 +02:00
Jeremy Lin
c05dc50f53
Add more docs on the email_token_size
setting
2020-08-22 17:35:55 -07:00
Jeremy Lin
d9684bef6b
Generate tokens more simply and uniformly
2020-08-22 16:07:53 -07:00
Jeremy Lin
db0c45c172
Sync global_domains.json to bitwarden/server@8383a08 (Yandex)
2020-08-20 03:31:21 -07:00
Jeremy Lin
ad4393e3f7
Sync global_domains.json to bitwarden/server@80f57d2 (Amazon updates)
2020-08-20 03:30:39 -07:00
Jeremy Lin
f83a8a36d1
Track favorites on a per-user basis
...
Currently, favorites are tracked at the cipher level. For org-owned ciphers,
this means that if one user sets it as a favorite, it automatically becomes a
favorite for all other users that the cipher has been shared with.
2020-08-19 02:32:58 -07:00
Jeremy Lin
0e9eba8c8b
Maximize similarity between MySQL and SQLite/PostgreSQL schemas
...
In particular, Diesel aliases `Varchar` to `Text`, and `Blob` to `Binary`:
* https://docs.diesel.rs/diesel/sql_types/struct.Text.html
* https://docs.diesel.rs/diesel/sql_types/struct.Binary.html
2020-08-19 02:32:56 -07:00
Jeremy Lin
d5c760960a
Sync global_domains.json to bitwarden/server@af85e17 (eBay India updates)
2020-08-19 00:40:59 -07:00
Jeremy Lin
2c6ef2bc68
Sync global_domains.json to bitwarden/server@2c43019 (eBay updates)
2020-08-15 01:34:12 -07:00
Jeremy Lin
7032ae5587
Sync global_domains.json to bitwarden/server@6aed80a (Amazon updates)
2020-08-15 01:32:56 -07:00
Jeremy Lin
6d9f03e84b
Sync global_domains.json to bitwarden/server@61b11e3
2020-08-12 21:10:31 -07:00
Daniel García
6a972e4b19
Make the admin URL redirect try to use the referrer first, and use /admin when DOMAIN is not configured and the referrer check doesn't work, to allow users without DOMAIN configured to use the admin page correctly
2020-08-12 19:07:52 +02:00
Daniel García
93b7ded1e6
Remove unneccessary shim for backtrace
2020-08-12 18:45:26 +02:00
Daniel García
29c6b145ca
Remove redundant user fetching from login
2020-08-11 16:48:15 +02:00
Daniel García
a7a479623c
Merge pull request #1087 from jjlin/org-creation-users
...
Add support for restricting org creation to certain users
2020-08-08 16:20:15 +02:00
Jeremy Lin
05b308b8b4
Sync global_domains.json with upstream
2020-08-06 12:13:40 -07:00
Jeremy Lin
570d6c8bf9
Add support for restricting org creation to certain users
2020-08-05 22:35:29 -07:00
Daniel García
ad48e9ed0f
Fix unlock on desktop clients
2020-08-04 15:12:04 +02:00
Jeremy Lin
a846f6c610
Fix soft delete notifications
...
A soft-deleted entry should now show up in the trash folder immediately
(previously, an extra sync was required).
2020-07-26 16:19:47 -07:00
Daniel García
fd1354d00e
Merge pull request #1067 from jjlin/log-time-fmt
...
Add config option for log timestamp format
2020-07-24 16:42:10 +02:00
Jeremy Lin
071a3b2a32
Log timestamps with milliseconds by default
2020-07-23 14:19:51 -07:00
Daniel García
32cfaab5ee
Updated dependencies and changed rocket request imports
2020-07-23 21:07:04 +02:00
Jeremy Lin
d348f12a0e
Add config option for log timestamp format
2020-07-22 21:50:49 -07:00
Jeremy Lin
de70fbf88a
Use strip_prefix()
instead of trim_start_matches()
as appropriate
...
As of Rust 1.45.0, `strip_prefix()` is now stable.
2020-07-20 22:33:13 -07:00
Daniel García
1e950c7dbc
Replace IP support in preparation for compiling on stable, included some tests to check that the code matches the unstable implementation
2020-07-15 00:00:03 +02:00
Daniel García
f14e19a3d8
Don't compile the regexes each time
2020-07-14 21:58:27 +02:00
Daniel García
668d5c23dc
Removed try_trait and some formatting, particularly around imports
2020-07-14 18:34:22 +02:00
Jeremy Lin
790146bfac
Fix error in PostgreSQL build
2020-07-10 17:23:02 -07:00
Jeremy Lin
a28ebcb401
Use local time in email notifications for new device logins
...
In this implementation, the `TZ` environment variable must be set
in order for the formatted output to use a more user-friendly
time zone abbreviation (e.g., `UTC`). Otherwise, the output uses
the time zone's UTC offset (e.g., `+00:00`).
2020-07-07 21:30:18 -07:00
Daniel García
77e47ddd1f
Merge pull request #1042 from jjlin/hide-passwords
...
Add support for hiding passwords in a collection
2020-07-06 18:56:06 +02:00
Daniel García
596c9b8691
Add option to set name during HELO in email settings
2020-07-05 01:59:15 +02:00
Armaan Tobaccowalla
624791e09a
Allow postgres:// DATABASE_URL
2020-07-04 16:13:27 -04:00
Jeremy Lin
f9a73a9bbe
More cipher optimization/cleanup
2020-07-03 10:49:10 -07:00
Jeremy Lin
35868dd72c
Optimize cipher queries
2020-07-03 09:00:33 -07:00
Jeremy Lin
979d010dc2
Add support for hiding passwords in a collection
...
Ref: https://github.com/bitwarden/server/pull/743
2020-07-02 21:51:20 -07:00
Daniel García
a87646b8cb
Some format changes to main.rs
2020-06-15 23:40:39 +02:00
BlackDex
24c914799d
Fixes #1022 cloning with attachments
...
When a cipher has one or more attachments it wasn't able to be cloned.
This commit fixes that issue.
2020-06-07 17:57:04 +02:00
BlackDex
325691e588
Fixed wrong status if there is an update.
...
- Checking the sha hash first if this is also in the server version.
- Added a badge to show if you are on a branched build.
2020-06-04 17:05:17 +02:00
Robert Kaussow
afbf1db331
add back openssl crate
2020-06-04 01:21:30 +02:00
BlackDex
ac2723f898
Updated Organizations overview
...
- Changed HTML to match users overview
- Added User count
- Added Org cipher amount
- Added Attachment count and size
2020-06-03 20:37:31 +02:00
BlackDex
2fffaec226
Added attachment info per user and some layout fix
...
- Added the amount and size of the attachments per user
- Changed the items count function a bit
- Some small layout changes
2020-06-03 17:57:03 +02:00
BlackDex
5c54dfee3a
Fixed an issue when DNS resolving fails.
...
In the event of a failed DNS Resolving checking for new versions will
cause a huge delay, and in the end a timeout when loading the page.
- Check if DNS resolving failed, if that is the case, do not check for
new versions
- Changed `fn get_github_api` to make use of structs
- Added a timeout of 10 seconds for the version check requests
- Moved the "Unknown" lables to the "Latest" lable
2020-06-03 17:07:32 +02:00
BlackDex
b47cf97409
Updated js/css libraries and fixed smallscreen err
...
- Updated bootstrap js and css to the latest version
- Fixed issue with small-screens where the menu overlaps the token input
- The menu now collapses to a hamburger menu
- Menu's only accessable when logedin are hidden when you are not
- Changed Users Overview to use a table to prevent small-screen issues.
2020-06-01 18:58:38 +02:00
Daniel García
5e802f8aa3
Update lettre to alpha release instead of git commit, and update the rest of dependencies while we are at it
2020-05-31 17:58:06 +02:00
Daniel García
0bdeb02a31
Merge pull request #1009 from jjlin/email-subject
...
Don't HTML-escape email subject lines
2020-05-31 00:22:58 +02:00
Jeremy Lin
39d1a09704
Avoid double-slashes in the admin URL
2020-05-30 01:06:40 -07:00
Jeremy Lin
a447e4e7ef
Don't HTML-escape email subject lines
...
For example, this causes org names like `X&Y` to appear as `X&Y`.
2020-05-30 00:36:43 -07:00
BlackDex
b6fde857a7
Added version check to diagnostics
...
- Added a version check based upon the github api information.
2020-05-28 20:25:25 +02:00
BlackDex
3c66deb5cc
Redesign of the admin interface.
...
Main changes:
- Splitted up settings and users into two separate pages.
- Added verified shield when the e-mail address has been verified.
- Added the amount of personal items in the database to the users overview.
- Added Organizations and Diagnostics pages.
- Shows if DNS resolving works.
- Shows if there is a posible time drift.
- Shows current versions of server and web-vault.
- Optimized logo-gray.png using optipng
Items which can be added later:
- Amount of cipher items accessible for a user, not only his personal items.
- Amount of users per Org
- Version update check in the diagnostics overview.
- Copy/Pasteable runtime config which has sensitive data changed or removed for support questions either on the forum or github issues.
- Option to delete Orgs and all its passwords (when there are no members anymore).
- Etc....
2020-05-28 10:46:25 +02:00
Jeremy Lin
a314933557
Allow email changes for existing accounts even when signups are disabled
2020-05-24 14:38:19 -07:00
Daniel García
c5d7e3f2bc
Merge pull request #1003 from frdescam/fix_arm_displaysize
...
Use format! for rounding to fix arm issue
2020-05-23 13:10:06 +02:00
Daniel García
c95a2881b5
Merge pull request #998 from frdescam/fix_email_templates
...
Fixing bad width in 2FA email template
2020-05-23 13:09:44 +02:00
fdeĉ
4c3727b4a3
use format! for rounding to fix arm issue
2020-05-22 12:10:56 +02:00
Daniel García
a8870eef0d
Convert to f32 before rounding to fix arm issue
2020-05-20 17:58:39 +02:00
François
afaebc6cf3
fixing hard coded width email templates
2020-05-20 13:38:04 +02:00
François
8f4a1f4fc2
fixing bad width in 2FA email template
2020-05-18 12:27:21 +02:00
Daniel García
0807783388
Add ip on totp miss
2020-05-14 00:19:50 +02:00
Daniel García
dc2f8e5c85
Merge pull request #994 from jjlin/help-text
...
Update startup banner to direct usage/config questions to the forum
2020-05-13 22:34:30 +02:00
Daniel García
aee1ea032b
Merge pull request #989 from theycallmesteve/update_responses
...
Update responses
2020-05-13 22:34:16 +02:00
Jeremy Lin
322a08edfb
Update startup banner to direct usage/config questions to the forum
2020-05-13 12:29:47 -07:00
theycallmesteve
08afc312c3
Add missing items to profileOrganization response model
2020-05-08 13:39:17 -04:00
theycallmesteve
5571a5d8ed
Update post_keys to return a keys response model
2020-05-08 13:38:49 -04:00
theycallmesteve
6a8c65493f
Rename collection_user_details to collection_read_only to reflect the response model
2020-05-08 13:37:40 -04:00
theycallmesteve
dfdf4473ea
Rename to_json_list to to_json_provder to reflect the response model
2020-05-08 13:36:35 -04:00
theycallmesteve
42e37ebea1
Apply upstream global domain values and whitespace fixes
2020-05-07 18:05:17 -04:00
theycallmesteve
632f4d5453
Whitespace fixes
2020-05-07 18:02:37 -04:00
Daniel García
6c5e35ce5c
Change the mails content types to more closely match what we sent before
2020-05-07 00:51:46 +02:00
Daniel García
4ff15f6dc2
Merge pull request #978 from AltiUP/patch-1
...
Delete the call to the map file
2020-05-03 22:30:06 +02:00
Daniel García
ec8028aef2
Merge pull request #979 from jjlin/admin-redirect
...
Use absolute URIs for admin page redirects
2020-05-03 22:27:09 +02:00
Daniel García
63cbd9ef9c
Update lettre to latest master
2020-05-03 17:41:53 +02:00
Daniel García
9cca64003a
Remove unused dependency and simple feature, update dependencies and fix some clippy lints
2020-05-03 17:24:51 +02:00
Jeremy Lin
819d5e2dc8
Use absolute URIs for admin page redirects
...
This is technically required per RFC 2616 (HTTP/1.1); some proxies will
rewrite a plain `/admin` path to an unexpected URL otherwise.
2020-05-01 00:31:47 -07:00
Christophe Gherardi
3b06ab296b
Delete the call to the map file
...
The file bootstrap.css.map is missing, the reference can be deleted.
2020-04-30 19:41:58 +02:00
Daniel García
0de52c6c99
Merge pull request #957 from jjlin/domain-whitelist
...
Domain whitelist cleanup and fixes
2020-04-18 12:08:48 +02:00
Daniel García
e3b00b59a7
Initial support for soft deletes
2020-04-17 22:35:27 +02:00
BlackDex
1ee8e44912
Fixed issue #965
...
PostgreSQL updates/inserts ignored None/null values.
This is nice for new entries, but not for updates.
Added derive option to allways add these none/null values for Option<>
variables.
This solves issue #965
2020-04-15 16:49:33 +02:00
Jeremy Lin
86685c1cd2
Ensure email domain comparison is case-insensitive
2020-04-11 14:51:36 -07:00
Jeremy Lin
0a68de6c24
Warn on empty ADMIN_TOKEN
instead of bailing out
...
The admin page will still be disabled.
Fixes #849 .
2020-04-09 20:55:08 -07:00
Jeremy Lin
e4d08836e2
Make org owner invitations respect the email domain whitelist
...
This closes a loophole where org owners can invite new users from any domain.
2020-04-09 01:51:05 -07:00
Jeremy Lin
c2a324e5da
Clean up domain whitelist logic
...
* Make `SIGNUPS_DOMAINS_WHITELIST` override the `SIGNUPS_ALLOWED` setting.
Otherwise, a common pitfall is to set `SIGNUPS_DOMAINS_WHITELIST` without
realizing that `SIGNUPS_ALLOWED=false` must also be set.
* Whitespace is now accepted in `SIGNUPS_DOMAINS_WHITELIST`. That is,
`foo.com, bar.com` is now equivalent to `foo.com,bar.com`.
* Add validation on `SIGNUPS_DOMAINS_WHITELIST`. For example, `foo.com,`
is rejected as containing an empty token.
2020-04-09 01:42:27 -07:00
Jeremy Lin
6cd8512bbd
Fix Duo auth failure with non-lowercased email addresses
2020-04-07 20:40:51 -07:00
Jeremy Lin
7407b8326a
Fix attachment size limit calculation
...
The config values (in KB) need to be converted to bytes when comparing
against total attachment sizes.
2020-03-31 02:30:28 -07:00
Daniel García
adf47827c9
Make sure the data field is always returned, otherwise the mobile apps seem to have issues
2020-03-30 22:19:50 +02:00
Jeremy Lin
862d401077
Fix WebSocket notifications
...
Ignore a missing `id` query param; it's unclear what this ID represents,
but it wasn't being used in the existing bitwarden_rs code, and no longer
seems to be sent in the latest versions of the official clients.
2020-03-26 19:26:44 -07:00
Jeremy Lin
c06162b22f
Handle devicePushToken
...
Mobile push isn't currently supported, but this should get rid of spurious
`Detected unexpected parameter during login: devicepushtoken` warnings.
2020-03-22 15:04:25 -07:00
Daniel García
7a6a3e4160
Set the cargo version and allow changing it during build time with BWRS_VERSION.
...
Also renamed GIT_VERSION because that's not the only source anymore.
2020-03-22 16:13:34 +01:00
Daniel García
94341f9f3f
Fix token error while accepting invite
2020-03-20 10:51:17 +01:00
Daniel García
ff19fb3426
Merge pull request #919 from BlackDex/issue-908
...
Fixed issue #908
2020-03-19 18:11:47 +01:00
BlackDex
baac8d9627
Fixed issue #908
...
The organization uuid is most of the time within the uri path as a
parameter. But sometimes it only is there as a query value.
This fix checks both, and returns the uuid when possible.
2020-03-19 17:37:10 +01:00
BlackDex
669b101e6a
Fixing issue #908
...
Sometimes an org-uuid is not within the path but in a query value,
This fixes the check for that.
2020-03-19 16:50:47 +01:00
Daniel García
d2d9fb08cc
Revert "Use opportunistic TLS in SMTP connections"
2020-03-19 13:56:53 +01:00
BlackDex
35f30088b2
Fixing issue #759 by disabling Foreign Key Checks.
...
During migrations some queries are out of order regarding to foreign
keys.
Because of this the migrations fail when the sql database has this
enforced by default.
Turning of this check during the migrations will fix this and this is
only per session.
2020-03-18 18:11:11 +01:00
Daniel García
dce054e632
Merge pull request #912 from ymage/openssl_as_default
...
Fix alpine build with openssl crate as default
2020-03-16 23:02:07 +01:00
Ymage
ba725e1c25
Make openssl crate as default (non feature-flipped)
2020-03-16 22:39:10 +01:00
Daniel García
7d9c7017c9
Merge pull request #911 from BlackDex/upgrade-rocket
...
Upgrade rocket
2020-03-16 18:17:17 +01:00
BlackDex
bd09fe1a3d
Updated code so backtraces are logged also.
2020-03-16 17:53:22 +01:00
BlackDex
bcbe6177b8
Merge branch 'master' of https://github.com/dani-garcia/bitwarden_rs into log-panics
2020-03-16 17:19:27 +01:00
BlackDex
9b1d07365e
Updated ring
...
Some small changes to match the updated ring package.
2020-03-16 16:39:20 +01:00
BlackDex
37b212427c
Updated jsonwebtoken
...
Updated to the latest version of jsonwebtoken.
Some small code changes to match the new versions.
2020-03-16 16:38:00 +01:00
BlackDex
078234d8b3
Small change for rocket compatibilty
2020-03-16 16:36:44 +01:00
Daniel García
2ee07ea1d8
Fix empty data when cloning cipher
2020-03-15 17:26:34 +01:00
Daniel García
40c339db9b
Fix postgres policies, second try
2020-03-14 23:53:12 +01:00
Daniel García
402c1cd06c
Merge pull request #906 from BlackDex/upgrade-reqwest
...
Updated reqwest to the latest version.
2020-03-14 23:35:52 +01:00
Daniel García
819f340f39
Fix issue with postgres
2020-03-14 23:35:34 +01:00
BlackDex
1b4b40c95d
Updated reqwest to the latest version.
...
- Use the blocking client (no async).
- Disabled gzip.
- use_sys_proxy is now default.
2020-03-14 23:12:45 +01:00
Daniel García
afd9f4e278
Allow the smtp mechanism to be provided without quotes and all lowercase
2020-03-14 22:31:41 +01:00
Daniel García
47a9461f39
Merge pull request #903 from TheBinaryLoop/patch-1
...
Updated domains with new values vualt
2020-03-14 14:41:39 +01:00
Daniel García
c6f64d8368
Merge pull request #901 from sleweke/feature/opportunistic_tls
...
Use opportunistic TLS in SMTP connections
2020-03-14 14:41:00 +01:00
Daniel García
a30d5f4cf9
Fix cloning issues
2020-03-14 14:08:57 +01:00
Daniel García
3fa78e7bb1
Initial version of policies
2020-03-14 13:32:28 +01:00
Lukas Eßmann
a8a7e4f9a5
Updated domains with new values vualt
...
Added domains from official vault.bitwarden.com
2020-03-13 20:08:52 +01:00
Samuel Leweke
5d3b765a23
Use opportunistic TLS in SMTP connections
...
If SSL is disabled, the SMTP ClientSecurity of the lettre crate
defaults to None, that is, an insecure connection. This is changed to
Opportunistic, which uses TLS if available. If TLS is not available,
the insecure connection is used (i.e., this change is backward
compatible).
2020-03-12 11:40:52 +01:00
Daniel García
70f3ab8ec3
Migrate lazy_static to once_cell, less macro magic and slightly faster
2020-03-09 22:04:03 +01:00
BlackDex
84dc2eda1f
Changed javascript default argument construction
2020-03-04 15:08:14 +01:00
BlackDex
390d10d656
Relocated SMTP test input+button.
...
- Moved smtp test option to within the "SMTP Email" Settings block.
- Added optional option to prevent full page reload.
- SMTP Test and Backup do not reload the admin interface any more.
2020-03-04 13:25:38 +01:00
zethra
cc404b4edc
Added command line flags for help and version
...
Signed-off-by: zethra <benaagoldberg@gmail.com>
2020-03-02 15:51:57 -05:00
BlackDex
97fb7b5b96
Added urlpath to smtpTest function
2020-02-26 16:58:57 +01:00
BlackDex
5a974c7b94
Added SMTP test button in the admin gui
...
- Added a test button for checking the e-mail settings.
- Fixed a bug with the _post JavaScript function:
A function was overwriten with a variable and errors were not handled
correctly like a 500 for example.
2020-02-26 16:49:56 +01:00
BlackDex
7439aeb63e
Make panics logable (as warn)
...
panic!()'s only appear on stderr, this makes tracking down some strange
issues harder with the usage of docker since stderr does not get logged
into the bitwarden.log file. This change logs the message to stdout and
the logfile when activated.
2020-02-25 14:10:52 +01:00
Daniel García
cd8907542a
Make sure the provided domain contains the protocol and show a useful error when it doesn't
2020-02-23 14:55:27 +01:00
Daniel García
ad9f2b2d8e
Removed test urlpath
2020-02-22 19:01:58 +01:00
Daniel García
2f4a9865e1
Use absolute paths in the admin page
2020-02-22 17:49:33 +01:00
Jeremy Lin
29a0795219
Add backend support for alternate base dir (subdir/subpath) hosting
...
To use this, include a path in the `DOMAIN` URL, e.g.:
* `DOMAIN=https://example.com/custom-path `
* `DOMAIN=https://example.com/multiple/levels/are/ok `
2020-02-18 21:27:00 -08:00
Daniel García
325039c316
Attachment size limits, per-user and per-organization
2020-02-17 22:56:26 +01:00
Miro Prasil
03233429f4
Remove check from Invitation:take()
...
I've checked the spots when `Invitation::new()` and `Invitation::take()`
are used and it seems like all spots are already correctly gated. So to
enable invitations via admin API even when invitations are otherwise
disabled, this check can be removed.
2020-02-16 20:28:50 +00:00
Miroslav Prasil
0a72c4b6db
Do not disable invitations via admin API
...
This was brought up today:
https://github.com/dani-garcia/bitwarden_rs/issues/752#issuecomment-586715073
I don't think it makes much sense in checking whether admin has the
right to send invitation as admin can change the setting anyway.
Removing the condition allows users to forbid regular users from
inviting new users to server while still preserving the option to do so
via the admin API.
2020-02-16 15:01:07 +00:00
Daniel García
8867626de8
Add option to change invitation org name, fixes #825
...
Add option to allow additional iframe ancestors, fixes #843
Sort the rocket routes before printing them
2020-02-04 22:14:50 +01:00
Daniel García
f5916ec396
Fix backwards indices
2020-01-30 22:33:50 +01:00
Daniel García
ebb36235a7
Cache icons in the clients
2020-01-30 22:30:57 +01:00
Daniel García
def174a517
Convert email domains to punycode
2020-01-30 22:11:53 +01:00
Daniel García
480ba933fa
Don't error if admin token is empty but disabled
2020-01-30 22:10:50 +01:00
Miro Prasil
c4101162d6
SIGNUPS_ALLOWED with no whitelist [ fixes #830 ]
...
This reverts back to `SIGNUPS_ALLOWED` when there is no domain whitelist
set. The functionality was broken in 64d6f72
.
2020-01-29 11:32:42 +00:00
Daniel García
632d55265b
Merge pull request #824 from tomuta/fix_change_email
...
Fix change email when no whitelist is configured
2020-01-28 20:52:16 +01:00
tomuta
e277f7d1c1
Fix change email when no whitelist is configured
...
Fixes issue #792
2020-01-26 13:34:56 -07:00
Daniel García
ff7b4a3d38
Update handlebars to 3.0 which included performance improvements.
...
Updated lettre to newer git revision, which should give better error messages now.
2020-01-26 15:29:14 +01:00
Daniel García
d212dfe735
Accept y/n, True/False, 1/0 as booleans in environment vars
2020-01-20 22:28:54 +01:00
Daniel García
84ed185579
Update u2f to 0.2, which requires OpenSSL but also might solve the problems we've had with certificates.
...
The rust image doesn't need installing curl or tar, so removed. Also collapsed ENV lines.
2020-01-19 21:34:13 +01:00
Michael Powers
e196ba6e86
Switch error handling to ? operator instead of explicit handling.
2020-01-16 08:14:25 -05:00
Michael Powers
76743aee48
Fixes #635 - Unique constraint violation when using U2F tokens on PostgreSQL
...
Because of differences in how .on_conflict() works compared to .replace_into() the PostgreSQL backend wasn't correctly ensuring the unique constraint on user_uuid and atype wasn't getting violated.
This change simply issues a DELETE on the unique constraint prior to the insert to ensure uniqueness. PostgreSQL does not support multiple constraints in ON CONFLICT clauses.
2020-01-13 21:53:57 -05:00
Daniel García
96a189deb9
Merge pull request #803 from aeolyus/master
...
Minor typo conect -> connect
2020-01-05 00:12:15 +01:00
Daniel García
8c229920ad
Protect websocket server against panics
2020-01-04 23:52:38 +01:00
Richard Huang
d592323e39
minor typo conect -> connect
2020-01-04 14:37:29 -08:00
Daniel García
36ae946655
Avoid some to_string in the request logging and include message to disable web vault when not found.
2019-12-29 15:34:22 +01:00
Daniel García
cb6f392774
When receiving a comma separated list as IP, pick the first
2019-12-28 15:09:07 +01:00
Daniel García
88c56de97b
Config option for client IP header
2019-12-27 18:42:39 +01:00
Daniel García
e274af6e3d
Print current server time when failing TOTP, and use chrono as the rest of the server
2019-12-27 18:42:14 +01:00
Daniel García
a0ece3754b
Formatting
2019-12-27 18:37:14 +01:00
Daniel García
2545469713
Fix crash when page URL points to huge file
2019-12-19 00:37:16 +01:00
Daniel García
5cabf4d040
Fix IP not shown when failed login ( Fixes #761 )
2019-12-07 14:38:32 +01:00
Daniel García
a03db6d224
Also hide options requests, unless using debug or trace
2019-12-06 22:55:29 +01:00
Daniel García
8d1b72b951
Collapsed log messages from 3 lines per request to 2 and hidden the ones valued as less informative.
...
Use LOG_LEVEL debug or trace to recover them.
Removed LOG_MOUNTS and bundled it with LOG_LEVEL debug and trace.
Removed duplicate error messages
Made websocket not proxied message more prominent, but only print it once.
2019-12-06 22:46:12 +01:00
Daniel García
912e1f93b7
Fix some lints
2019-12-06 22:12:41 +01:00
Daniel García
adc443ea80
Add endpoint to delete specific U2F key
2019-12-01 21:41:46 +01:00
Daniel García
0d32179d07
Logout button in admin page
2019-12-01 21:15:14 +01:00
Daniel García
12928b832c
Fix broken tests
2019-11-30 23:30:35 +01:00
Daniel García
1e224220a8
Updated deps and fixed some lints
2019-11-28 21:59:05 +01:00
Daniel García
924ba153aa
Merge pull request #730 from tomuta/email_verification
...
Implement change-email, email-verification, account-recovery, and welcome notifications
2019-11-25 08:21:18 +01:00
tomuta
bd1e8be328
Implement change-email, email-verification, account-recovery, and welcome notifications
2019-11-24 22:28:49 -07:00
Daniel García
4b71197c97
Merge pull request #738 from ntimo/task/add-netcup-global-domains
...
Added netcup domains to global domains
2019-11-22 15:54:21 +01:00
BlackDex
b209c1bc4d
Add an option to fetch and parse href="data:image"
...
Some sites are using base64 encoded inline images for favicons.
This will try to match those with some sane checks and return that.
These icons will have lower prio then the icons with a normal URL.
2019-11-22 13:16:12 +01:00
ntimo
2b8d08a3f4
Added netcup domains to global domains
2019-11-21 08:31:18 +01:00
Daniel García
cbadf00941
Update web vault to fix twofactorauth.org integration
...
Update dependencies and toolchain
Update included equivalent domains with upstream changes
2019-11-19 20:30:09 +01:00
tomuta
64d6f72e6c
Add the ability to disable signups, but allow signups from a whitelist
...
This feature can be enabled by setting SIGNUPS_ALLOWED=false and
providing a comma-separated list of whitelisted domains in
SIGNUPS_DOMAINS_WHITELIST.
Fixes #727
2019-11-16 15:01:45 -07:00
Timo N
b889e5185e
Added tv.apple.com to global domains
2019-11-14 23:10:55 +01:00
BlackDex
3f6809bcdf
Fixed issue/request #705
...
Added a config option to disable time drifted totp codes.
Default is false, since this is what the RFC recommends.
2019-11-07 17:11:29 +01:00
BlackDex
c52adef919
Added configurable smtp timeout.
...
- Added config option for smtp timeout
- Lowered default timeout to 15 seconds instead of default 60.
2019-11-06 21:39:33 +01:00
BlackDex
2ffc3eac4d
Clippy fix
2019-11-06 20:34:52 +01:00
BlackDex
0ff7fd939e
Next attempt for issue #709 fix
...
Now creates icon cache directory at startup.
And it also creates the directory if it went missing during runtime.
Also modified the icon_save/mark_negcache to be one.
2019-11-06 20:21:47 +01:00
BlackDex
ca7c5129b2
Fixed issue #709 creating icon_cache directory.
...
When the icon_cache directory doesn't exists yet, and the first icon
catched is a miss this .miss file was not able to be created since the
directory was only created during a valid icon download.
2019-11-06 15:47:56 +01:00
Daniel García
b4dfc24040
Merge pull request #703 from patrickli/bugfix/dont-sync-excluded-global-domains
...
Don't include excluded global equivalent domains during sync
2019-11-05 18:47:43 +01:00
Patrick Li
85dbf4e16c
Don't include excluded global equivalent domains during sync
...
Fixes #681
2019-11-05 21:29:04 +13:00
BlackDex
3442eb1b9d
Trying to fix issue #687
...
- Using an older commit from rocket repo
2019-11-04 14:30:24 +01:00
Daniel García
e449912f05
Generate recovery codes for email and duo
2019-11-02 18:31:50 +01:00
Daniel García
d29b6bee28
Remove unnecessary clones and other clippy fixes
2019-11-02 17:39:01 +01:00
Miro Prasil
00a11b1b78
Stop leaking usernames when SIGNUPS_ALLOWED=false
...
This fixes #691 - respond in less specific way to not leak the
fact that user is already registered on the server.
2019-11-01 22:34:42 +00:00
BlackDex
ee550be80c
Added http favicon url when response failed
2019-10-29 14:24:01 +01:00
Daniel García
fccc0a4b05
Update rocket to latest master
...
Downgrade rust version to fix cargo issue
Set rustup profile to minimal
2019-10-25 21:48:10 +02:00
Jellyfrog
ebc47dc161
Remove unneeded WS logging
2019-10-17 17:15:11 +02:00
vpl
3b7a5bd102
Move 2FA email config to after SMTP config
2019-10-16 07:11:16 +02:00
vpl
2edecf34ff
Use user_uuid instead of mut twofactor
2019-10-15 21:20:19 +02:00
vpl
18bc8331f9
Send email when preparing 2FA JsonError
2019-10-15 21:19:49 +02:00
BlackDex
603a964579
Fixed issue #663 .
...
During the 2fa activation there is no twofactor record yet.
Changed the layout a bit so that it will generate a new twofactor record
when it does not exists yet. Else it will just update the already
existing record.
2019-10-14 00:32:44 +02:00
Daniel García
dc515b83f3
Merge pull request #657 from BlackDex/totp-timedrift
...
Updated authenticator TOTP
2019-10-12 16:33:43 +02:00
BlackDex
9466f02696
Recoded TOTP time drift validation
2019-10-12 15:28:28 +02:00
BlackDex
2cde814aaa
Fixed a bug with the sqlite backup feature.
...
When a custom path is used the backup feature does not work.
Changed it so it will take the path of the sqlite file and use that.
2019-10-11 12:08:40 +02:00
BlackDex
d989a19f76
Merge branch 'master' of https://github.com/dani-garcia/bitwarden_rs into totp-timedrift
2019-10-11 11:22:13 +02:00
Daniel García
d292269ea0
Make the blacklist logic be cached
2019-10-10 23:21:22 +02:00
BlackDex
ebf40099f2
Updated authenticator TOTP
...
- Added security check for previouse used codes
- Allow TOTP codes with 1 step back and forward when there is a time
drift. This means in total 3 codes could be valid. But only newer codes
then the previouse used codes are excepted after that.
2019-10-10 17:32:20 +02:00
BlackDex
edc482c8ea
Changed HIBP Error message.
...
- Moved the manual link to the check to the top.
- Clearified that hibp is a payed service.
- Changed error logo to hibp logo.
2019-10-08 22:29:12 +02:00
BlackDex
6e5c03cc78
Some modification when no HIBP API Key is set
...
- Added an URL with the useraccount for manual check.
- Added support for HTTP(S)_PROXY for hibp.
2019-10-08 21:39:11 +02:00
Daniel García
881c1978eb
Error when the URL scheme doesn't match the database type
2019-10-08 19:34:47 +02:00
Daniel García
662bc27523
Updated dependencies and fixed disable_admin_token description
2019-10-08 19:33:27 +02:00
Daniel García
e6b763026e
Merge branch 'master' into icon-security
2019-10-05 16:45:36 +02:00
Daniel García
c182583e09
Merge pull request #644 from BlackDex/issue-565
...
Fixed issue #565
2019-10-05 16:17:43 +02:00
Daniel García
d821389c2e
Merge pull request #639 from vverst/cors-update
...
Change CORS headers
2019-10-05 16:09:33 +02:00
BlackDex
be2916333b
Fixed issue #565
...
Issue fixed by omitting the cookie header when cookie_str is empty
2019-10-05 15:45:09 +02:00
BlackDex
9124d8a3fb
Updated icon blacklisting.
...
- Blacklisting was not effective for redirects and rel href
- Able to blacklist non global IP's like RFC1918, multicast etc...
2019-10-05 14:48:15 +02:00
vpl
7b1da527a6
Change CORS headers
...
Only add Allow-Origin to all requests and move the others to preflight OPTIONS request.
If Origin is `file://` change it to the wildcard.
2019-10-01 20:12:33 +02:00
Miro Prasil
d6e9af909b
Remove the unnecessary check for sqlite
...
The binary we use is called `sqlite3` so no need to check for other
name variants as we won't use those anyways.
2019-10-01 10:40:22 +01:00
Miro Prasil
acdd42935b
Add sqlite binary into the docker images
...
This is done to enable backup functionality in the admin interface while
we're waiting for the libsqlite-sys 0.17 to bubble up in the upstream
dependencies. Then we can start using `VACUUM INTO`
This also extends the check for the sqlite binary to also try `sqlite3`
as this is the name of the binary in baseimage distributions we use.
2019-09-30 13:54:06 +01:00
vpl
56f12dc982
Use Access-Control-Allow-Method
2019-09-23 07:44:44 +02:00
Daniel García
4c07f05b3a
Remove Result<T, E: Debug> in preparation of deprecation as Rocket responder.
...
Removed unnecessary returns
2019-09-17 21:05:56 +02:00
Michael Powers
f5f9861a78
Adds support for PostgreSQL which resolves #87 and is mentioned in #246 .
...
This includes migrations as well as Dockerfile's for amd64.
The biggest change is that replace_into isn't supported by Diesel for the
PostgreSQL backend, instead requiring the use of on_conflict. This
unfortunately requires a branch for save() on all of the models currently
using replace_into.
2019-09-12 16:12:22 -04:00
Daniel García
df8114f8be
Updated client kdf iterations to 100000 and fixed some lints
2019-09-05 21:56:12 +02:00
vpl
5a2f968d7a
Set correct response headers, status code
2019-09-02 21:13:12 +02:00
vpl
16d88402cb
Initial version of CORS support
2019-09-01 13:00:12 +02:00
Daniel García
7dcf18151d
Fix onsubmit
2019-08-31 17:57:47 +02:00
Daniel García
e3404dd322
Use the local scripts instead of cloudflare, remove jquery and update config so disabling a master toggle doesn't remove the values
2019-08-31 17:47:52 +02:00
Daniel García
bfc517ee80
Remove unused warning
2019-08-31 17:26:16 +02:00
Daniel García
4a7d2a1e28
Rename static files endpoint
2019-08-31 17:25:31 +02:00
Daniel García
c07c9995ea
Merge pull request #555 from vverst/email-codes
...
Add Email 2FA login
2019-08-27 21:07:41 +02:00
ViViDboarder
672a245548
Remove unecessary clone
2019-08-27 10:40:38 -07:00
vpl
5d50b1ee3c
Merge remote-tracking branch 'upstream/master' into email-codes
2019-08-26 21:38:45 +02:00
vpl
c99df1c310
Compare token using crypto::ct_eq
2019-08-26 20:26:59 +02:00
vpl
591ae10144
Get token from single u64
2019-08-26 20:26:54 +02:00
ViViDboarder
2d2745195e
Allow explicitly defined smtp auth mechansim
2019-08-23 16:22:14 -07:00
Daniel García
026f9da035
Allow removing users two factors
2019-08-21 17:13:06 +02:00
Daniel García
d23d4f2c1d
Allow editing HIBP key in the admin panel
2019-08-20 23:53:00 +02:00
Daniel García
515b87755a
Update HIBP to v3, requires paid API key, fixes #583
2019-08-20 20:07:12 +02:00
vpl
ee7837d022
Add option to require new device emails
2019-08-19 22:14:00 +02:00
Daniel García
07743e490b
Ignore error sending device email
2019-08-18 19:32:26 +02:00
BlackDex
e7b6238f43
Added reqwest proxy support
2019-08-12 17:24:32 +02:00
vpl
ad2225b6e5
Add configuration options for Email 2FA
2019-08-10 22:39:04 +02:00
vpl
5609103a97
Use ring to generate email token
2019-08-06 22:38:08 +02:00
vpl
6d460b44b0
Use saved token for email 2fa codes
2019-08-04 17:21:57 +02:00
vpl
efd8d9f528
Remove some unused imports, unneeded mut variables
2019-08-04 16:56:41 +02:00
vpl
29aedd388e
Add email code logic and move two_factor into separate modules
2019-08-04 16:56:41 +02:00
vpl
27e0e41835
Add email authenticator logic
2019-08-04 16:56:39 +02:00
vpl
0b60f20eb3
Add email message for twofactor email codes
2019-08-03 18:49:34 +02:00
Daniel García
c9c3f07171
Updated dependencies and fixed panic getting icons
2019-07-30 19:42:05 +02:00
vpl
df71f57d86
Move send device email to end of password login
...
Send new device email after two factor authentication.
2019-07-25 21:10:27 +02:00
vpl
60e39a9dd1
Move retrieve/new device from connData to separate function
2019-07-22 12:30:26 +02:00
vpl
bc6a53b847
Add new device email when user logs in
2019-07-22 08:26:24 +02:00
Daniel García
05a1137828
Move backend checks to build.rs to fail fast, and updated dependencies
2019-07-09 17:26:34 +02:00
Nick Fox
2e300da057
Fix #468 - Percent-encode the email address in invite link
2019-07-02 22:55:13 -04:00
Cubity_First
6989fc7bdb
Corrected Spelling
...
Changed it from Chache to Cache on Line 207
2019-06-18 15:45:19 +01:00
Daniel García
76f38621de
Update dependencies and remove unwraps from Cipher::to_json
2019-06-14 22:51:50 +02:00
Daniel García
12af32b9ea
Don't print DB URL
2019-06-02 13:39:16 +02:00
Daniel García
9add8e19eb
Update dependencies and remove travis unused feature
2019-06-02 00:28:20 +02:00
Daniel García
5710703c50
Make sure the backup option only appears when using sqlite
2019-06-02 00:08:52 +02:00
Daniel García
1322b876e9
Merge pull request #493 from endyman/feature/initial_mysql_support
...
Initial support for mysql
2019-06-01 23:33:06 +02:00
Daniel García
9ed2ba61c6
Merge pull request #475 from TheMardy/master
...
Create Backup funcitonality
2019-06-01 23:29:58 +02:00
Nils Domrose
62a461ae15
remove syslog from ci, make features flag more clear
2019-05-30 22:19:58 +02:00
Nils Domrose
4859932d35
fixed typo
2019-05-28 07:48:17 +02:00
Nils Domrose
dc36f0cb6c
re-added sqlite check_db code, cleanup
2019-05-27 22:58:52 +02:00
Nils Domrose
ff759397f6
initial mysql support
2019-05-26 23:03:05 +02:00
Emil Madsen
233b48bdad
Fix missing joinable in schema
2019-05-20 21:30:31 +02:00
Emil Madsen
e22e290f67
Fix key and type variable names for mysql
2019-05-20 21:24:29 +02:00
Emil Madsen
ab95a69dc8
Rework migrations for MySQL
2019-05-20 21:12:41 +02:00
Emil Madsen
85c8a01f4a
Merge branch 'master' of github.com:Skeen/bitwarden_rs
2019-05-20 19:53:18 +02:00
Emil Madsen
42af7c6dab
MySQL database
2019-05-20 19:53:14 +02:00
Daniel García
4f45cc081f
Update ring to 0.14, jwt to 6.0, and u2f
2019-05-11 23:18:18 +02:00
TheMardy
ef551f4cc6
Create Backup funcitonality
...
Added create backup functionality to the admin panel
2019-05-03 15:46:29 +02:00
Daniel García
5521a86693
Change path for served images to avoid collision with vault images
2019-05-01 16:19:22 +02:00
Daniel García
3160780549
Merge pull request #401 from TheMardy/master
...
Images in Email Templates
2019-04-30 17:52:10 +02:00
TheMardy
f0701657a9
Changed to Bitwarden_RS Logo
2019-04-30 16:08:53 +02:00
Daniel García
874f5c34bd
Formatting
2019-04-26 22:08:26 +02:00
Daniel García
253faaf023
Use users duo host when required, instead of always using the global one
2019-04-15 13:07:23 +02:00
Daniel García
3d843a6a51
Merge pull request #460 from janost/organization-vault-purge
...
Fixed purging organization vault
2019-04-14 22:30:51 +02:00
janost
03fdf36bf9
Fixed purging organization vault
2019-04-14 22:12:48 +02:00
Daniel García
fdcc32beda
Validate Duo credentials when custom
2019-04-14 22:05:05 +02:00
Daniel García
bf20355c5e
Merge branch 'duo'
2019-04-14 22:02:55 +02:00
Daniel García
0136c793b4
Implement better user status API, in the future we'll probably want a way to disable users.
...
We should migrate from the empty password hash to a separate column then.
2019-04-13 00:01:52 +02:00
Daniel García
2e12114350
Always create the user when inviting from admin panel
2019-04-12 23:44:49 +02:00
ViViDboarder
d3a8a278e6
Add new endpoint for retrieving all users
2019-04-11 11:24:53 -07:00
Daniel García
8d9827c55f
Implement selection between global config and user settings for duo keys.
2019-04-11 18:40:03 +02:00
Daniel García
cad63f9761
Auto generate akey
2019-04-11 16:08:26 +02:00
Daniel García
bf446f44f9
Enable DATA_FOLDER to affect default CONFIG_FILE path
2019-04-11 15:41:13 +02:00
Daniel García
621f607297
Update dependencies and fix some warnings
2019-04-11 15:40:19 +02:00
Daniel García
754087b990
Add global duo config and document options in .env template
2019-04-07 18:58:15 +02:00
Daniel García
cfbeb56371
Implement user duo, initial version
...
TODO:
- At the moment each user needs to configure a DUO application and input the API keys, we need to check if multiple users can register with the same keys correctly and if so we could implement a global setting.
- Sometimes the Duo frame doesn't load correctly, but canceling, reloading the page and logging in again seems to fix it for me.
2019-04-05 22:09:53 +02:00
Daniel García
c5832f2b30
With the latest fern, syslog can be a config option instead of a build flag
2019-03-29 20:27:20 +01:00
Daniel García
2475c36a75
Implement log_level config option
2019-03-25 14:23:14 +01:00
Daniel García
c384f9c0ca
Set default log level to Info, we don't use debug anyway and it just fills the logs with other crates info.
2019-03-25 14:21:50 +01:00
BlackDex
6b686c18f7
Fixed long e-mail message extending 1000 lines.
...
- Added quoted_printable crate to encode the e-mail messages.
- Change the way the e-mail gets build to use custom part headers.
2019-03-25 09:48:19 +01:00
Nick Fox
7976d39d9d
Adjust whitespace
2019-03-20 23:29:29 -04:00
Nick Fox
5ee9676941
Break up long line to stop SMTP from breaking
2019-03-20 23:24:30 -04:00
Daniel García
4b40cda910
Added domain blacklist regex for icons service and improved valid domain check.
...
Reorganized the icons code a bit.
2019-03-18 22:12:39 +01:00
Daniel García
4689ed7b30
Changed uppercase deserializer to avoid a clone.
2019-03-18 22:02:37 +01:00
Daniel García
61515160a7
Allow changing error codes and create an empty error.
...
Return 404 instead of 400 when no accounts breached.
2019-03-14 00:17:36 +01:00
Daniel García
e93538cea9
Add option to use wrapped TLS in email, instead of STARTTLS upgrade
2019-03-10 14:45:42 +01:00
Daniel García
b4244b28b6
Update admin page scripts and fixed broken tooltip
2019-03-09 14:41:34 +01:00
Daniel García
43f9038325
Add option to force resync clients in admin panel
2019-03-07 21:08:33 +01:00
Daniel García
339044f8aa
Add warning about config panel values overriding env vars.
2019-03-07 20:22:02 +01:00
Daniel García
0718a090e1
Trim spaces from admin token during authentication and validate that the admin panel token is not empty
2019-03-07 20:21:50 +01:00
Daniel García
9e1f030a80
Explicitly close SMTP connection in case of error.
2019-03-07 20:21:10 +01:00
Daniel García
04922f6aa0
Some formatting and dependency updates
2019-03-03 16:11:55 +01:00
Daniel García
7d2bc9e162
Added option to force 2fa at logins and made some changes to two factor code.
...
Added newlines to config options to keep them a reasonable length.
2019-03-03 16:09:15 +01:00
Daniel García
10756b0920
Update dependencies and fix some lints
2019-02-27 17:21:04 +01:00
Frank Petrilli
d156170971
Minor typo fix conect => connect
2019-02-24 16:08:38 -08:00
Дамјан Георгиевски
473f8b8e31
remove some unneeded mutability
2019-02-22 20:25:50 +01:00
Daniel García
5794969f5b
Merge pull request #406 from shauder/feature/disable-admin-token
...
Allow the Admin token to be disabled in the advanced menu
2019-02-20 23:06:52 +01:00
Shane Faulkner
8b5b06c3d1
Allow the Admin token to be disabled in the advanced menu
2019-02-20 14:56:08 -06:00
Daniel García
b50c27b619
Print a warning when an env variable is being overriden by the config file, and reorganize the main file a bit.
...
Modified the JWT key generation, now it should also show the output of OpenSSL in the logs.
2019-02-20 20:59:37 +01:00
Daniel García
5ee04e31e5
Updated dependencies, removed some unnecessary clones and fixed some lints
2019-02-20 17:54:18 +01:00
Daniel García
bf6ae91a6d
Remove margins on small devices
2019-02-18 20:43:34 +01:00
Daniel García
828e3a5795
Add extra padding when the toolbar collapses in small devices
2019-02-18 20:33:32 +01:00
Daniel García
7b5bcd45f8
Show read-only options in the config panel and the env variable names in the tooltips
2019-02-18 19:25:33 +01:00
Miroslav Prasil
0b903fc5f4
Extended the template file and refer to wiki
2019-02-18 14:57:21 +00:00
Miroslav Prasil
4df686f49e
Add an option to not enable WAL (should help in #399 )
2019-02-18 10:48:48 +00:00
Daniel García
d7eeaaf249
Escape user data from admin panel when calling JS
2019-02-17 15:24:14 +01:00
TheMardy
84fb6aaddb
Set correct MIME type
2019-02-17 01:08:24 +01:00
Daniel García
a744b9437a
Implemented multiple U2f keys, key names, and compromised checks
2019-02-16 23:07:48 +01:00
Daniel García
6027b969f5
Delete old devices when deauthorizing user sessions
2019-02-16 23:06:26 +01:00
Daniel García
93805a5d7b
Fix Yubikeys deleted on error
2019-02-16 21:30:55 +01:00
TheMardy
8526055bb7
Added images to email templates
2019-02-16 03:48:23 +01:00
TheMardy
a79334ea4c
Added static email image routes
2019-02-16 03:44:30 +01:00
Daniel García
d3773a433a
Removed list of mounted routes at startup by default, with option to add it back. This would get annoying when starting the server frequently, because it printed ~130 lines of mostly useless info
2019-02-13 00:03:16 +01:00
Daniel García
0f0a87becf
Add version to initial message
2019-02-12 22:47:00 +01:00
BlackDex
3b27dbb0aa
Added config option for icon download timeout
2019-02-12 21:56:28 +01:00
Daniel García
9636f33fdb
Implement constant time equal check for admin, 2fa recover and 2fa remember tokens
2019-02-11 23:45:55 +01:00
Daniel García
79fdfd6524
Add missing url parameter
2019-02-10 21:40:20 +01:00
Daniel García
d086a99e5b
Implemented HTML emails with text alternative
2019-02-10 19:12:34 +01:00
TheMardy
22b0b95209
Added HTML templates (+14 squashed commit)
...
Squashed commit:
[ece2260] Plaintext send_org_invite
[01d4884] Plaintext pw_hint_some
[6ce5173] Plaintext pw_hint_none
[881af3e] Plaintext invite_confirmed
[ce78621] Plaintext invite_accepted
[13a44a4] Rename send_org_invite.hbs to send_org_invite.html.hbs
[b52bf2f] Rename pw_hint_some.hbs to pw_hint_some.html.hbs
[e0d1aeb] Rename pw_hint_none.hbs to pw_hint_none.html.hbs
[898dbcd] Rename invite_confirmed.hbs to invite_confirmed.html.hbs
[107af31] Rename invite_accepted.hbs to invite_accepted.html.hbs
[d26d662] Updated send_org_invite template
[71f47af] Updated pw_hint_some template
[c2ca3c2] Updated pw_hint_none template
[50f8bfb] Updated invite_accepted template
[17f96f8] Updated invite_confirmed template
2019-02-10 19:04:18 +01:00
Daniel García
28d1588e73
Show version in admin panel
2019-02-10 16:02:46 +01:00
Daniel García
f3b1a5ff3e
Error when admin panel is disabled
2019-02-10 15:26:19 +01:00
Daniel García
330e90a6ac
Hide secrets in config panel
2019-02-08 20:49:04 +01:00
Daniel García
820c8b0dce
Change use of deserialize_with for Option iterator
2019-02-08 19:12:08 +01:00
Daniel García
8b4a6f2a64
Fixed some clippy lints and changed update_uuid_revision to only use one db query
2019-02-08 18:45:07 +01:00
Daniel García
ef63342e20
Add reset user config button
2019-02-06 17:34:32 +01:00
Daniel García
89840790e7
Fix .env path traversal issue
2019-02-06 17:34:31 +01:00
Daniel García
a72809b225
Yubico and SMTP enable/disable master switches
2019-02-06 17:34:31 +01:00
Daniel García
9976e4736e
Add groups
2019-02-06 17:34:31 +01:00
Daniel García
dc92f07232
Added env variable to select config file. Initial work towards groups and added tooltips with descriptions and nicer names
2019-02-06 17:34:30 +01:00
Daniel García
3db815b969
Implemented config form and fixed config priority
2019-02-06 17:34:30 +01:00
Daniel García
ade293cf52
Save config
2019-02-06 17:34:29 +01:00
Daniel García
877408b808
Implement basic config loading and updating. No save to file yet.
2019-02-06 17:34:29 +01:00
Daniel García
86ed75bf7c
Config can now be serialized / deserialized
2019-02-06 17:34:29 +01:00
Daniel García
20d8d800f3
Updated dependencies
2019-02-06 17:34:29 +01:00
Miroslav Prasil
08ca47cadb
Update revision when adding or removing cipher from collection
2019-02-06 14:47:47 +00:00
Miroslav Prasil
5272b465cc
Update revision of affected users when deleting Collection
2019-02-06 13:39:32 +00:00
Miroslav Prasil
637f655b6f
Do not allocate uneccessary Vec
2019-02-05 14:16:07 +00:00
Miroslav Prasil
b3f7394c06
Do not update revision at the end, as we already did that
2019-02-05 14:09:59 +00:00
Miroslav Prasil
1a5ecd4d4a
cipher does not need to be mutable
2019-02-05 13:52:30 +00:00
Miroslav Prasil
bd65c4e312
Remove superfluous cipher.save() call
2019-02-05 13:49:30 +00:00
Miroslav Prasil
bce656c787
Retry updating revision - fixes #383
2019-02-05 11:52:11 +00:00
BlackDex
9026cc8d42
Fixed issue when the iconlist is smaller then 5
...
When the iconlist was smaller then 5 items, it would cause a panic.
Solved by using .truncate() on the iconlist.
2019-02-04 17:27:40 +01:00
BlackDex
574b040142
Loop through the iconlist until an icon is found
...
Loop for a maximum of 5 times through the iconlist or until a
successful download of an icon.
2019-02-04 16:59:52 +01:00
BlackDex
c13f115473
Fixed issue #380
...
- Created a separate function for parsing the sizes attribute
- Parsing sizes now with regex
- Should work with any non-digit separator
2019-02-04 12:55:39 +01:00
BlackDex
bc461d9baa
Some small changes on the iter of the cookies
2019-01-31 17:58:03 +01:00
BlackDex
5016e30cf2
Added cookies to the icon download request.
...
Some sites use XSRF Tokens, or other Tokens to verify a subseqense
response. The cookies which are sent during the page request are now
used when downloading the favicon.
A site which uses this is mijn.ing.nl.
2019-01-31 15:49:58 +01:00
Daniel García
f42ac5f2c0
Update web vault error message
2019-01-29 21:45:25 +01:00
Daniel García
2a60414031
Reuse the client between requests, and use the client when downloading the icons themselves
2019-01-29 21:21:26 +01:00
BlackDex
feb74a5e86
Changed the way to fix the href
...
- Using url from reqwest to fix href, this fixes:
+ "//domain.com/icon.png"
+ "relative/path/to/icon.png"
+ "/absolute/path/to/icon.png"
- Removed fix_href function
- Some variable changes
2019-01-29 18:08:23 +01:00
Daniel García
c0e350b734
Disable icon downloads, accept optional query after icon href, format and clippy fixes
2019-01-28 23:58:32 +01:00
Daniel García
bef1183c49
Only send one notification per vault import and purge, improve move ciphers functions
2019-01-28 00:39:14 +01:00
Daniel García
f935f5cf46
Remove local icon extractor
2019-01-27 16:42:30 +01:00
Daniel García
07388d327f
Merge pull request #370 from BlackDex/favicons
...
Added better favicon downloader.
2019-01-27 16:37:47 +01:00
BlackDex
4de16b2d17
Removed unwrap and added ?
2019-01-27 16:25:02 +01:00
BlackDex
da068a43c1
Moved function call to get_icon_url to prevent error bubbeling
2019-01-27 16:03:18 +01:00
BlackDex
9657463717
Added better favicon downloader.
2019-01-27 15:39:19 +01:00
Daniel García
69036cc6a4
Add disabled user badge (no password) and deauthorize button to admin page.
2019-01-26 19:28:54 +01:00
Daniel García
700e084101
Add 2FA icon to admin panel
2019-01-25 18:50:57 +01:00
Daniel García
a1dc47b826
Change config to thread-safe system, needed for a future config panel.
...
Improved some two factor methods.
2019-01-25 18:24:57 +01:00
Daniel García
86de0ca17b
Fix editing users from collections menu
2019-01-25 17:43:51 +01:00
Stephen White
fc0e239bdf
No point calling find_by_uuid now we don't use the result.
2019-01-25 14:25:15 +00:00
Stephen White
928ad6c1d8
Fix the list of users with access to a collection to display correctly.
...
https://github.com/dani-garcia/bitwarden_rs/issues/364
2019-01-25 14:18:06 +00:00
Daniel García
ddd49596ba
Fix invite empty email
2019-01-22 17:26:17 +01:00
Daniel García
b8cabadd43
Fix admin page links
2019-01-21 23:41:27 +01:00
Daniel García
ce42b07a80
Update Diesel to 1.4 and other dependencies
2019-01-21 15:29:52 +01:00
Daniel García
bfd93e5b13
Show organizations in admin panel, implement reload templates option
2019-01-20 17:43:56 +01:00
Daniel García
a797459560
Implement HIBP check [WIP].
...
Add extra security attributes to admin cookie.
Error handling.
2019-01-20 15:36:33 +01:00
Daniel García
6cbb683f99
Rename admin templates to match email
2019-01-19 22:59:32 +01:00
Daniel García
92bbb98d48
Created base template
2019-01-19 22:12:52 +01:00
Daniel García
834c847746
Implement admin JWT cookie, separate JWT issuers for each type of token and migrate admin page to handlebars template
2019-01-19 21:41:49 +01:00
Daniel García
97aa407fe4
Move email templates to subfolder
2019-01-19 17:40:18 +01:00
TBK
d8116a80df
Add Feature-Policy header
2019-01-17 21:08:31 +01:00
Daniel García
e0aec8d373
Use new i64::to_be_bytes and remove byteorder dep
...
(https://doc.rust-lang.org/stable/std/primitive.i64.html#method.to_be_bytes )
2019-01-16 22:14:17 +01:00
Daniel García
1ce2587330
Correct update cipher order: first save cipher, then cipher-folder, then notify
2019-01-16 19:57:49 +01:00
Miroslav Prasil
71a10e0378
Fix sharing the item to organization.
2019-01-16 11:33:43 +00:00
Daniel García
9bf13b7872
Can't return inside multipart closure
2019-01-15 22:00:41 +01:00
Daniel García
d420992f8c
Update some function calls to use ?
2019-01-15 21:47:16 +01:00
Daniel García
c259a0e3e2
Save recovery code when using yubikey and stop repeating headers.user everywhere
2019-01-15 21:38:21 +01:00
Daniel García
432be274ba
Improve org mismatch check, consider different orgs
2019-01-15 17:31:03 +01:00
Daniel García
484bf5b703
Check that the client is not updating an outdated cipher, that should be part of an org now
2019-01-15 16:35:08 +01:00
Daniel García
4bf32af60e
Fix folder notifications, enable template strict mode and add missing option to env template
2019-01-15 15:28:47 +01:00
Daniel García
0e4a746eeb
Added SMTP_FROM_NAME
2019-01-15 15:28:47 +01:00
Daniel García
2fe919cc5e
Embed the default templates
2019-01-15 15:28:46 +01:00
Daniel García
bcd750695f
Default to $data_folder/templates and remove dev option (use TEMPLATES_FOLDER=src/static/templates
instead)
2019-01-15 15:28:46 +01:00
Daniel García
19b6bb0fd6
Initial stab at templates
2019-01-15 15:28:46 +01:00
Daniel García
f571df7367
Revert yubikey feature, not needed anymore
2019-01-12 15:28:41 +01:00
Daniel García
de51bc782e
Updated dependencies, removing need for yubico fork
2019-01-12 15:23:46 +01:00
Daniel García
c5aef60bd7
Implement unofficial warning message
2019-01-11 14:20:42 +01:00
Daniel García
6f52104324
Fix casing error in Attachment, should fix 'Attachment doesn't exist' errors
2019-01-11 01:35:15 +01:00
Daniel García
1d7f704754
Send CipherUpdate when adding and deleting attachments
2019-01-11 01:12:54 +01:00
Daniel García
1d034749f7
Fix AArch64 build by disabling yubico
2019-01-10 23:54:01 +01:00
Daniel García
320266606e
Implement put collections
2019-01-08 20:27:28 +01:00
Daniel García
a0a08c4c5a
Include IP in invalid admin token error
2019-01-08 16:17:18 +01:00
Daniel García
4309df8334
Only create invitations when SMTP is disabled, and ignore invitations if we have a token.
...
Disallow users from accepting invitation twice
2019-01-08 15:42:26 +01:00
Daniel García
f1161c65fb
Make sure an invitation is created when reinviting
2019-01-08 14:05:05 +01:00
Daniel García
50eeb4f651
Remove whitespace before processing tokens
2019-01-07 20:37:14 +01:00
Daniel García
21b85b78b1
Changed reinvite check and removed obsolete comment
2019-01-07 15:29:57 +01:00
Daniel García
673adde9f1
Make the admin retype the user name before deleting
2019-01-07 14:48:10 +01:00
Daniel García
c9063a06b4
Print unauthorized error message
2019-01-07 02:18:51 +01:00
Daniel García
5e37471488
Merge pull request #323 from njfox/invite_accepted_email
...
Send email notifications when invitations are accepted/confirmed
2019-01-06 14:12:24 +01:00
Nick Fox
0a74e79cea
Refactor generate_invite_claims, make org_name and org_id optional
2019-01-05 23:03:49 -05:00
Nick Fox
7db66f73f0
Refactor invited_by_email check
2019-01-05 13:46:45 -05:00
Nick Fox
2f5bdc23f6
Fix formatting and add vault link to notification emails
2019-01-05 13:36:08 -05:00
Nick Fox
cec28a85ac
Update admin page to work with new invitation flow
2019-01-04 10:32:51 -05:00
Daniel García
5f49ecd7f3
Updated dependencies to use u2f crate directly, and some style changes
2019-01-04 00:25:38 +01:00
Nick Fox
736c0e62f2
Send emails to inviters/invitees when invites are accepted/confirmed
2019-01-02 22:20:39 -05:00
Nick Fox
43eb064351
Replace invite/reinvite email functions with generic send_email
2019-01-02 22:19:44 -05:00
Daniel García
30e768613b
Start using rustfmt and some style changes to make some lines shorter
2018-12-30 23:34:31 +01:00
Daniel García
adb8052689
Updated Error to implement Display and Debug, instead of using custom methods
2018-12-30 21:43:56 +01:00
Daniel García
1483829c94
Removed invalid todo
2018-12-30 21:43:56 +01:00
Daniel García
acb9d1b3c6
Remove config option for admin email, embdedded admin page, managed IO::Error, and added security and cache headers globally
2018-12-30 21:43:56 +01:00
Daniel García
301919d9d4
Modified navigation bar and corrected some comments
2018-12-30 21:43:55 +01:00
Daniel García
2bb0b15e04
Implemented better errors for JWT
2018-12-30 21:43:55 +01:00
Daniel García
250a2b340f
Use new Errors in latest changes
2018-12-30 21:43:55 +01:00
Daniel García
b2fc0499f6
Finish invite functionality, and remove virtual organization
2018-12-30 21:40:26 +01:00
Daniel García
6a99849a1e
Implemented proper error handling, now we can do user.save($conn)?;
and it works.
...
In the future, maybe we can do the same with the `find_by_id` methods that return an Option.
2018-12-30 21:31:12 +01:00
Daniel García
172f1770cf
Embed the icon in the binary, no need to download when it's not going to change
2018-12-30 21:31:12 +01:00
Daniel García
1b5134dfe2
Fixed delete user when 2FA is enabled, implemented delete user for admin panel, and the front-end part for invite user. Secured admin panel behind a configurable token.
2018-12-30 21:31:11 +01:00
Daniel García
5fecf09631
Initial version of admin panel, list users and reload user list works. No serious auth method yet, password is 'token123'
2018-12-30 21:31:11 +01:00
Daniel García
7d7d8afed9
Merge pull request #318 from njfox/reinvite_endpoint
...
Add email reinvite endpoint
2018-12-30 21:22:26 +01:00
Nick Fox
f20c4705d9
Refactor invite claims and disallow reinvites to virtual_org
2018-12-30 00:19:01 -05:00
Nick Fox
3142d8d01f
Add more detail to invitation not found error
2018-12-29 23:28:19 -05:00