saret/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2025-09-11 11:15:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

Validate note sizes on key-rotation.

Browse Source 
We also need to validate the note sizes on key-rotation.
If we do not validate them before we store them, that could lead to a
partial or total loss of the password vault. Validating these
restrictions before actually processing them to store/replace the
existing ciphers should prevent this.

There was also a small bug when using web-sockets. The client which is
triggering the password/key-rotation change should not be forced to
logout via a web-socket request. That is something the client will
handle it self. Refactored the logout notification to either send the
device uuid or not on specific actions.

Fixes #3152
This commit is contained in:
BlackDex
2023-01-20 15:43:45 +01:00
parent 9b7e86efc2
commit 34ac16e9d7
3 changed files with 30 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/api/admin.rs
View File

@@ -13,7 +13,7 @@ use rocket::{
};
use crate::{
api::{core::log_event, ApiResult, EmptyResult, JsonResult, Notify, NumberOrString, UpdateType},
api::{core::log_event, ApiResult, EmptyResult, JsonResult, Notify, NumberOrString},
auth::{decode_admin, encode_jwt, generate_admin_claims, ClientIp},
config::ConfigBuilder,
db::{backup_database, get_sql_server_version, models::*, DbConn, DbConnType},
@@ -372,7 +372,7 @@ async fn deauth_user(uuid: String, _token: AdminToken, mut conn: DbConn, nt: Not
let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await;
nt.send_logout(&user, None).await;
save_result
}
@@ -386,7 +386,7 @@ async fn disable_user(uuid: String, _token: AdminToken, mut conn: DbConn, nt: No
let save_result = user.save(&mut conn).await;
nt.send_user_update(UpdateType::LogOut, &user).await;
nt.send_logout(&user, None).await;
save_result
}