saret/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.wiki.git synced 2026-08-07 22:57:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

Trusted proxy support, unauthenticated rate limit & other fixes (#7472)

Browse Source 
* Trusted proxies, unauthenticated rate limits and various fixes

* Fix get_groups_data

* Fix get_groups_data when not using full_access

* Fmt

* Fix org import

* deduplicate send validation
This commit is contained in:
Daniel García
2026-07-24 18:27:32 +02:00
committed by GitHub
parent a6a88e7929
commit 46ae59eaf4
21 changed files with 415 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/core/sends.rs
+21 -28
View File
@@ -453,6 +453,9 @@ async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> Json
let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
err_code!(SEND_INACCESSIBLE_MSG, 404)
};
if !send.is_accessible() {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
process_access(send, conn, nt).await
}
@@ -471,6 +474,8 @@ async fn post_access_legacy(
ip: ClientIp,
nt: Notify<'_>,
) -> JsonResult {
crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
let Some(mut send) = Send::find_by_access_id(access_id, &conn).await else {
err_code!(SEND_INACCESSIBLE_MSG, 404)
};
@@ -481,17 +486,7 @@ async fn post_access_legacy(
err_code!(SEND_INACCESSIBLE_MSG, 404);
}
if let Some(expiration) = send.expiration_date
&& Utc::now().naive_utc() >= expiration
{
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
if Utc::now().naive_utc() >= send.deletion_date {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
if send.disabled {
if !send.is_accessible() {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
@@ -505,11 +500,13 @@ async fn post_access_legacy(
// Files are incremented during the download
if send.atype == SendType::Text as i32 {
send.access_count += 1;
if !send.register_access(&conn).await? {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
} else {
send.save(&conn).await?;
}
send.save(&conn).await?;
process_access(send, conn, nt).await
}
@@ -537,6 +534,9 @@ async fn post_access_file(
let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
err_code!(SEND_INACCESSIBLE_MSG, 404)
};
if !send.is_accessible() {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
process_access_file(send, file_id, host, conn, nt).await
}
@@ -548,8 +548,11 @@ async fn post_access_file_legacy(
data: Json<SendAccessData>,
host: Host,
conn: DbConn,
ip: ClientIp,
nt: Notify<'_>,
) -> JsonResult {
crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
let Some(mut send) = Send::find_by_uuid(&send_id, &conn).await else {
err_code!(SEND_INACCESSIBLE_MSG, 404)
};
@@ -560,17 +563,7 @@ async fn post_access_file_legacy(
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
if let Some(expiration) = send.expiration_date
&& Utc::now().naive_utc() >= expiration
{
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
if Utc::now().naive_utc() >= send.deletion_date {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
if send.disabled {
if !send.is_accessible() {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
@@ -582,9 +575,9 @@ async fn post_access_file_legacy(
}
}
send.access_count += 1;
send.save(&conn).await?;
if !send.register_access(&conn).await? {
err_code!(SEND_INACCESSIBLE_MSG, 404)
}
process_access_file(send, file_id, host, conn, nt).await
}