vw_small

Hardened fork of Vaultwarden (https://github.com/dani-garcia/vaultwarden) with fewer features.
git clone https://git.philomathiclife.com/repos/vw_small
Log | Files | Refs | README

commit b17e2da2cfecc0cc318b7a2b656ac0ad06ea889b
parent 0eba7a88fa085c3f746143418abba239dcc5850f
Author: Daniel GarcĂ­a <dani-garcia@users.noreply.github.com>
Date:   Tue, 24 Jan 2023 19:47:20 +0100

Merge branch 'BlackDex-issue-3152'

Diffstat:
Msrc/api/admin.rs | 6+++---
Msrc/api/core/accounts.rs | 22+++++++++++++++++-----
Msrc/api/notifications.rs | 10++++++++++
3 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs @@ -13,7 +13,7 @@ use rocket::{ }; use crate::{ - api::{core::log_event, ApiResult, EmptyResult, JsonResult, Notify, NumberOrString, UpdateType}, + api::{core::log_event, ApiResult, EmptyResult, JsonResult, Notify, NumberOrString}, auth::{decode_admin, encode_jwt, generate_admin_claims, ClientIp}, config::ConfigBuilder, db::{backup_database, get_sql_server_version, models::*, DbConn, DbConnType}, @@ -372,7 +372,7 @@ async fn deauth_user(uuid: String, _token: AdminToken, mut conn: DbConn, nt: Not let save_result = user.save(&mut conn).await; - nt.send_user_update(UpdateType::LogOut, &user).await; + nt.send_logout(&user, None).await; save_result } @@ -386,7 +386,7 @@ async fn disable_user(uuid: String, _token: AdminToken, mut conn: DbConn, nt: No let save_result = user.save(&mut conn).await; - nt.send_user_update(UpdateType::LogOut, &user).await; + nt.send_logout(&user, None).await; save_result } diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs @@ -323,7 +323,10 @@ async fn post_password( let save_result = user.save(&mut conn).await; - nt.send_user_update(UpdateType::LogOut, &user).await; + // Prevent loging out the client where the user requested this endpoint from. + // If you do logout the user it will causes issues at the client side. + // Adding the device uuid will prevent this. + nt.send_logout(&user, Some(headers.device.uuid)).await; save_result } @@ -353,7 +356,7 @@ async fn post_kdf(data: JsonUpcase<ChangeKdfData>, headers: Headers, mut conn: D user.set_password(&data.NewMasterPasswordHash, &data.Key, None); let save_result = user.save(&mut conn).await; - nt.send_user_update(UpdateType::LogOut, &user).await; + nt.send_logout(&user, Some(headers.device.uuid)).await; save_result } @@ -391,6 +394,12 @@ async fn post_rotatekey( err!("Invalid password") } + // Validate the import before continuing + // Bitwarden does not process the import if there is one item invalid. + // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it. + // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks. + Cipher::validate_notes(&data.Ciphers)?; + let user_uuid = &headers.user.uuid; // Update folder data @@ -437,7 +446,10 @@ async fn post_rotatekey( let save_result = user.save(&mut conn).await; - nt.send_user_update(UpdateType::LogOut, &user).await; + // Prevent loging out the client where the user requested this endpoint from. + // If you do logout the user it will causes issues at the client side. + // Adding the device uuid will prevent this. + nt.send_logout(&user, Some(headers.device.uuid)).await; save_result } @@ -460,7 +472,7 @@ async fn post_sstamp( user.reset_security_stamp(); let save_result = user.save(&mut conn).await; - nt.send_user_update(UpdateType::LogOut, &user).await; + nt.send_logout(&user, None).await; save_result } @@ -563,7 +575,7 @@ async fn post_email( let save_result = user.save(&mut conn).await; - nt.send_user_update(UpdateType::LogOut, &user).await; + nt.send_logout(&user, None).await; save_result } diff --git a/src/api/notifications.rs b/src/api/notifications.rs @@ -170,6 +170,16 @@ impl WebSocketUsers { self.send_update(&user.uuid, &data).await; } + pub async fn send_logout(&self, user: &User, acting_device_uuid: Option<String>) { + let data = create_update( + vec![("UserId".into(), user.uuid.clone().into()), ("Date".into(), serialize_date(user.updated_at))], + UpdateType::LogOut, + acting_device_uuid, + ); + + self.send_update(&user.uuid, &data).await; + } + pub async fn send_folder_update(&self, ut: UpdateType, folder: &Folder, acting_device_uuid: &String) { let data = create_update( vec![