681 Commits

Author	SHA1	Message	Date
theycallmesteve	5571a5d8ed	Update post_keys to return a keys response model	2020-05-08 13:38:49 -04:00
theycallmesteve	6a8c65493f	Rename collection_user_details to collection_read_only to reflect the response model	2020-05-08 13:37:40 -04:00
theycallmesteve	dfdf4473ea	Rename to_json_list to to_json_provder to reflect the response model	2020-05-08 13:36:35 -04:00
theycallmesteve	42e37ebea1	Apply upstream global domain values and whitespace fixes	2020-05-07 18:05:17 -04:00
theycallmesteve	632f4d5453	Whitespace fixes	2020-05-07 18:02:37 -04:00
Daniel García	6c5e35ce5c	Change the mails content types to more closely match what we sent before	2020-05-07 00:51:46 +02:00
Daniel García	4ff15f6dc2	Merge pull request #978 from AltiUP/patch-1 ... Delete the call to the map file	2020-05-03 22:30:06 +02:00
Daniel García	ec8028aef2	Merge pull request #979 from jjlin/admin-redirect ... Use absolute URIs for admin page redirects	2020-05-03 22:27:09 +02:00
Daniel García	63cbd9ef9c	Update lettre to latest master	2020-05-03 17:41:53 +02:00
Daniel García	9cca64003a	Remove unused dependency and simple feature, update dependencies and fix some clippy lints	2020-05-03 17:24:51 +02:00
Jeremy Lin	819d5e2dc8	Use absolute URIs for admin page redirects ... This is technically required per RFC 2616 (HTTP/1.1); some proxies will rewrite a plain `/admin` path to an unexpected URL otherwise.	2020-05-01 00:31:47 -07:00
Christophe Gherardi	3b06ab296b	Delete the call to the map file ... The file bootstrap.css.map is missing, the reference can be deleted.	2020-04-30 19:41:58 +02:00
Daniel García	0de52c6c99	Merge pull request #957 from jjlin/domain-whitelist ... Domain whitelist cleanup and fixes	2020-04-18 12:08:48 +02:00
Daniel García	e3b00b59a7	Initial support for soft deletes	2020-04-17 22:35:27 +02:00
BlackDex	1ee8e44912	Fixed issue #965 ... PostgreSQL updates/inserts ignored None/null values. This is nice for new entries, but not for updates. Added derive option to allways add these none/null values for Option<> variables. This solves issue #965	2020-04-15 16:49:33 +02:00
Jeremy Lin	86685c1cd2	Ensure email domain comparison is case-insensitive	2020-04-11 14:51:36 -07:00
Jeremy Lin	0a68de6c24	Warn on empty ADMIN_TOKEN instead of bailing out ... The admin page will still be disabled. Fixes #849.	2020-04-09 20:55:08 -07:00
Jeremy Lin	e4d08836e2	Make org owner invitations respect the email domain whitelist ... This closes a loophole where org owners can invite new users from any domain.	2020-04-09 01:51:05 -07:00
Jeremy Lin	c2a324e5da	Clean up domain whitelist logic ... * Make `SIGNUPS_DOMAINS_WHITELIST` override the `SIGNUPS_ALLOWED` setting. Otherwise, a common pitfall is to set `SIGNUPS_DOMAINS_WHITELIST` without realizing that `SIGNUPS_ALLOWED=false` must also be set. * Whitespace is now accepted in `SIGNUPS_DOMAINS_WHITELIST`. That is, `foo.com, bar.com` is now equivalent to `foo.com,bar.com`. * Add validation on `SIGNUPS_DOMAINS_WHITELIST`. For example, `foo.com,` is rejected as containing an empty token.	2020-04-09 01:42:27 -07:00
Jeremy Lin	6cd8512bbd	Fix Duo auth failure with non-lowercased email addresses	2020-04-07 20:40:51 -07:00
Jeremy Lin	7407b8326a	Fix attachment size limit calculation ... The config values (in KB) need to be converted to bytes when comparing against total attachment sizes.	2020-03-31 02:30:28 -07:00
Daniel García	adf47827c9	Make sure the data field is always returned, otherwise the mobile apps seem to have issues	2020-03-30 22:19:50 +02:00
Jeremy Lin	862d401077	Fix WebSocket notifications ... Ignore a missing `id` query param; it's unclear what this ID represents, but it wasn't being used in the existing bitwarden_rs code, and no longer seems to be sent in the latest versions of the official clients.	2020-03-26 19:26:44 -07:00
Jeremy Lin	c06162b22f	Handle devicePushToken ... Mobile push isn't currently supported, but this should get rid of spurious `Detected unexpected parameter during login: devicepushtoken` warnings.	2020-03-22 15:04:25 -07:00
Daniel García	7a6a3e4160	Set the cargo version and allow changing it during build time with BWRS_VERSION. ... Also renamed GIT_VERSION because that's not the only source anymore.	2020-03-22 16:13:34 +01:00
Daniel García	94341f9f3f	Fix token error while accepting invite	2020-03-20 10:51:17 +01:00
Daniel García	ff19fb3426	Merge pull request #919 from BlackDex/issue-908 ... Fixed issue #908	2020-03-19 18:11:47 +01:00
BlackDex	baac8d9627	Fixed issue #908 ... The organization uuid is most of the time within the uri path as a parameter. But sometimes it only is there as a query value. This fix checks both, and returns the uuid when possible.	2020-03-19 17:37:10 +01:00
BlackDex	669b101e6a	Fixing issue #908 ... Sometimes an org-uuid is not within the path but in a query value, This fixes the check for that.	2020-03-19 16:50:47 +01:00
Daniel García	d2d9fb08cc	Revert "Use opportunistic TLS in SMTP connections"	2020-03-19 13:56:53 +01:00
BlackDex	35f30088b2	Fixing issue #759 by disabling Foreign Key Checks. ... During migrations some queries are out of order regarding to foreign keys. Because of this the migrations fail when the sql database has this enforced by default. Turning of this check during the migrations will fix this and this is only per session.	2020-03-18 18:11:11 +01:00
Daniel García	dce054e632	Merge pull request #912 from ymage/openssl_as_default ... Fix alpine build with openssl crate as default	2020-03-16 23:02:07 +01:00
Ymage	ba725e1c25	Make openssl crate as default (non feature-flipped)	2020-03-16 22:39:10 +01:00
Daniel García	7d9c7017c9	Merge pull request #911 from BlackDex/upgrade-rocket ... Upgrade rocket	2020-03-16 18:17:17 +01:00
BlackDex	bd09fe1a3d	Updated code so backtraces are logged also.	2020-03-16 17:53:22 +01:00
BlackDex	bcbe6177b8	Merge branch 'master' of https://github.com/dani-garcia/bitwarden_rs into log-panics	2020-03-16 17:19:27 +01:00
BlackDex	9b1d07365e	Updated ring ... Some small changes to match the updated ring package.	2020-03-16 16:39:20 +01:00
BlackDex	37b212427c	Updated jsonwebtoken ... Updated to the latest version of jsonwebtoken. Some small code changes to match the new versions.	2020-03-16 16:38:00 +01:00
BlackDex	078234d8b3	Small change for rocket compatibilty	2020-03-16 16:36:44 +01:00
Daniel García	2ee07ea1d8	Fix empty data when cloning cipher	2020-03-15 17:26:34 +01:00
Daniel García	40c339db9b	Fix postgres policies, second try	2020-03-14 23:53:12 +01:00
Daniel García	402c1cd06c	Merge pull request #906 from BlackDex/upgrade-reqwest ... Updated reqwest to the latest version.	2020-03-14 23:35:52 +01:00
Daniel García	819f340f39	Fix issue with postgres	2020-03-14 23:35:34 +01:00
BlackDex	1b4b40c95d	Updated reqwest to the latest version. ... - Use the blocking client (no async). - Disabled gzip. - use_sys_proxy is now default.	2020-03-14 23:12:45 +01:00
Daniel García	afd9f4e278	Allow the smtp mechanism to be provided without quotes and all lowercase	2020-03-14 22:31:41 +01:00
Daniel García	47a9461f39	Merge pull request #903 from TheBinaryLoop/patch-1 ... Updated domains with new values vualt	2020-03-14 14:41:39 +01:00
Daniel García	c6f64d8368	Merge pull request #901 from sleweke/feature/opportunistic_tls ... Use opportunistic TLS in SMTP connections	2020-03-14 14:41:00 +01:00
Daniel García	a30d5f4cf9	Fix cloning issues	2020-03-14 14:08:57 +01:00
Daniel García	3fa78e7bb1	Initial version of policies	2020-03-14 13:32:28 +01:00
Lukas Eßmann	a8a7e4f9a5	Updated domains with new values vualt ... Added domains from official vault.bitwarden.com	2020-03-13 20:08:52 +01:00
Samuel Leweke	5d3b765a23	Use opportunistic TLS in SMTP connections ... If SSL is disabled, the SMTP ClientSecurity of the lettre crate defaults to None, that is, an insecure connection. This is changed to Opportunistic, which uses TLS if available. If TLS is not available, the insecure connection is used (i.e., this change is backward compatible).	2020-03-12 11:40:52 +01:00
Daniel García	70f3ab8ec3	Migrate lazy_static to once_cell, less macro magic and slightly faster	2020-03-09 22:04:03 +01:00
BlackDex	84dc2eda1f	Changed javascript default argument construction	2020-03-04 15:08:14 +01:00
BlackDex	390d10d656	Relocated SMTP test input+button. ... - Moved smtp test option to within the "SMTP Email" Settings block. - Added optional option to prevent full page reload. - SMTP Test and Backup do not reload the admin interface any more.	2020-03-04 13:25:38 +01:00
zethra	cc404b4edc	Added command line flags for help and version ... Signed-off-by: zethra <benaagoldberg@gmail.com>	2020-03-02 15:51:57 -05:00
BlackDex	97fb7b5b96	Added urlpath to smtpTest function	2020-02-26 16:58:57 +01:00
BlackDex	5a974c7b94	Added SMTP test button in the admin gui ... - Added a test button for checking the e-mail settings. - Fixed a bug with the _post JavaScript function: A function was overwriten with a variable and errors were not handled correctly like a 500 for example.	2020-02-26 16:49:56 +01:00
BlackDex	7439aeb63e	Make panics logable (as warn) ... panic!()'s only appear on stderr, this makes tracking down some strange issues harder with the usage of docker since stderr does not get logged into the bitwarden.log file. This change logs the message to stdout and the logfile when activated.	2020-02-25 14:10:52 +01:00
Daniel García	cd8907542a	Make sure the provided domain contains the protocol and show a useful error when it doesn't	2020-02-23 14:55:27 +01:00
Daniel García	ad9f2b2d8e	Removed test urlpath	2020-02-22 19:01:58 +01:00
Daniel García	2f4a9865e1	Use absolute paths in the admin page	2020-02-22 17:49:33 +01:00
Jeremy Lin	29a0795219	Add backend support for alternate base dir (subdir/subpath) hosting ... To use this, include a path in the `DOMAIN` URL, e.g.: * `DOMAIN=https://example.com/custom-path` * `DOMAIN=https://example.com/multiple/levels/are/ok`	2020-02-18 21:27:00 -08:00
Daniel García	325039c316	Attachment size limits, per-user and per-organization	2020-02-17 22:56:26 +01:00
Miro Prasil	03233429f4	Remove check from Invitation:take() ... I've checked the spots when `Invitation::new()` and `Invitation::take()` are used and it seems like all spots are already correctly gated. So to enable invitations via admin API even when invitations are otherwise disabled, this check can be removed.	2020-02-16 20:28:50 +00:00
Miroslav Prasil	0a72c4b6db	Do not disable invitations via admin API ... This was brought up today: https://github.com/dani-garcia/bitwarden_rs/issues/752#issuecomment-586715073 I don't think it makes much sense in checking whether admin has the right to send invitation as admin can change the setting anyway. Removing the condition allows users to forbid regular users from inviting new users to server while still preserving the option to do so via the admin API.	2020-02-16 15:01:07 +00:00
Daniel García	8867626de8	Add option to change invitation org name, fixes #825 ... Add option to allow additional iframe ancestors, fixes #843 Sort the rocket routes before printing them	2020-02-04 22:14:50 +01:00
Daniel García	f5916ec396	Fix backwards indices	2020-01-30 22:33:50 +01:00
Daniel García	ebb36235a7	Cache icons in the clients	2020-01-30 22:30:57 +01:00
Daniel García	def174a517	Convert email domains to punycode	2020-01-30 22:11:53 +01:00
Daniel García	480ba933fa	Don't error if admin token is empty but disabled	2020-01-30 22:10:50 +01:00
Miro Prasil	c4101162d6	SIGNUPS_ALLOWED with no whitelist [fixes #830] ... This reverts back to `SIGNUPS_ALLOWED` when there is no domain whitelist set. The functionality was broken in 64d6f72.	2020-01-29 11:32:42 +00:00
Daniel García	632d55265b	Merge pull request #824 from tomuta/fix_change_email ... Fix change email when no whitelist is configured	2020-01-28 20:52:16 +01:00
tomuta	e277f7d1c1	Fix change email when no whitelist is configured ... Fixes issue #792	2020-01-26 13:34:56 -07:00
Daniel García	ff7b4a3d38	Update handlebars to 3.0 which included performance improvements. ... Updated lettre to newer git revision, which should give better error messages now.	2020-01-26 15:29:14 +01:00
Daniel García	d212dfe735	Accept y/n, True/False, 1/0 as booleans in environment vars	2020-01-20 22:28:54 +01:00
Daniel García	84ed185579	Update u2f to 0.2, which requires OpenSSL but also might solve the problems we've had with certificates. ... The rust image doesn't need installing curl or tar, so removed. Also collapsed ENV lines.	2020-01-19 21:34:13 +01:00
Michael Powers	e196ba6e86	Switch error handling to ? operator instead of explicit handling.	2020-01-16 08:14:25 -05:00
Michael Powers	76743aee48	Fixes #635 - Unique constraint violation when using U2F tokens on PostgreSQL ... Because of differences in how .on_conflict() works compared to .replace_into() the PostgreSQL backend wasn't correctly ensuring the unique constraint on user_uuid and atype wasn't getting violated. This change simply issues a DELETE on the unique constraint prior to the insert to ensure uniqueness. PostgreSQL does not support multiple constraints in ON CONFLICT clauses.	2020-01-13 21:53:57 -05:00
Daniel García	96a189deb9	Merge pull request #803 from aeolyus/master ... Minor typo conect -> connect	2020-01-05 00:12:15 +01:00
Daniel García	8c229920ad	Protect websocket server against panics	2020-01-04 23:52:38 +01:00
Richard Huang	d592323e39	minor typo conect -> connect	2020-01-04 14:37:29 -08:00
Daniel García	36ae946655	Avoid some to_string in the request logging and include message to disable web vault when not found.	2019-12-29 15:34:22 +01:00
Daniel García	cb6f392774	When receiving a comma separated list as IP, pick the first	2019-12-28 15:09:07 +01:00
Daniel García	88c56de97b	Config option for client IP header	2019-12-27 18:42:39 +01:00
Daniel García	e274af6e3d	Print current server time when failing TOTP, and use chrono as the rest of the server	2019-12-27 18:42:14 +01:00
Daniel García	a0ece3754b	Formatting	2019-12-27 18:37:14 +01:00
Daniel García	2545469713	Fix crash when page URL points to huge file	2019-12-19 00:37:16 +01:00
Daniel García	5cabf4d040	Fix IP not shown when failed login (Fixes #761)	2019-12-07 14:38:32 +01:00
Daniel García	a03db6d224	Also hide options requests, unless using debug or trace	2019-12-06 22:55:29 +01:00
Daniel García	8d1b72b951	Collapsed log messages from 3 lines per request to 2 and hidden the ones valued as less informative. ... Use LOG_LEVEL debug or trace to recover them. Removed LOG_MOUNTS and bundled it with LOG_LEVEL debug and trace. Removed duplicate error messages Made websocket not proxied message more prominent, but only print it once.	2019-12-06 22:46:12 +01:00
Daniel García	912e1f93b7	Fix some lints	2019-12-06 22:12:41 +01:00
Daniel García	adc443ea80	Add endpoint to delete specific U2F key	2019-12-01 21:41:46 +01:00
Daniel García	0d32179d07	Logout button in admin page	2019-12-01 21:15:14 +01:00
Daniel García	12928b832c	Fix broken tests	2019-11-30 23:30:35 +01:00
Daniel García	1e224220a8	Updated deps and fixed some lints	2019-11-28 21:59:05 +01:00
Daniel García	924ba153aa	Merge pull request #730 from tomuta/email_verification ... Implement change-email, email-verification, account-recovery, and welcome notifications	2019-11-25 08:21:18 +01:00
tomuta	bd1e8be328	Implement change-email, email-verification, account-recovery, and welcome notifications	2019-11-24 22:28:49 -07:00
Daniel García	4b71197c97	Merge pull request #738 from ntimo/task/add-netcup-global-domains ... Added netcup domains to global domains	2019-11-22 15:54:21 +01:00
BlackDex	b209c1bc4d	Add an option to fetch and parse href="data:image" ... Some sites are using base64 encoded inline images for favicons. This will try to match those with some sane checks and return that. These icons will have lower prio then the icons with a normal URL.	2019-11-22 13:16:12 +01:00
ntimo	2b8d08a3f4	Added netcup domains to global domains	2019-11-21 08:31:18 +01:00