saret/vaultwarden
1
0 Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.wiki.git synced 2026-10-23 01:18:09 +03:00
Code Issues Packages Projects Releases Wiki Activity
3,106 Commits 9 Branches 89 Tags
42aa3ee1c77758086abe8cb16df7d9f222fe6885
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel García 895ec2b1e7 Align API behaviour with upstream and return errors on malformed input (#7810) 
- Attachments: reject a declared v2 attachment size above the upload limit,
  keep display sizes within the largest unit, and make download links valid
  for 1 minute like upstream.
- Ciphers: moving a personal cipher into an organization needs collection
  write access or full access, like upstream.
- Events: /events/collect only accepts the client event types upstream accepts.
- Client IP: for list headers like X-Forwarded-For, use the rightmost address
  that isn't in IP_HEADER_TRUSTED_PROXIES, reading every occurrence.
- Prelogin: unknown emails get stable KDF settings from upstream's list.
- Login with device: an auth request can be used for one login, like upstream.
- Directory Connector import: never revokes, restores or removes Owners,
  like upstream.
- SSO: check the PKCE verifier again when the code exchange is reused during
  2FA, and accept the same redirect URIs as upstream (desktop localhost
  callback for AppImage and dev builds, CLI on ports 8065-8070).
- Identity: send the merged master password policy in the 2FA response and
  use PascalCase policy keys in identity responses, like upstream.
  Organization API key login no longer needs device fields. Recovery code
  login normalises the code, uses upstream's error message, logs a failed 2FA
  event and sends a "two-step login recovered" email.
- Add GET /api/accounts/keys.
- Return errors instead of panicking on malformed event dates, cipher data,
  key rotation cipher ids, bulk confirm entries and YubiKey OTPs.
 2026-10-05 14:38:01 +02:00
Daniel García 1f99d9d276 Remove legacy API endpoints and compatibility code dropped upstream (#7809) 
Remove endpoints, response fields, feature flags and compatibility code
that upstream Bitwarden has removed and that no current client uses:

- Legacy POST /identity/accounts/register and POST /api/accounts/prelogin;
  register/finish is rate limited like the other unauthenticated endpoints.
- Legacy organization routes: PUT groups/{id}/users, PUT policies/{type}/vnext,
  PUT users/{id}/reset-password, GET billing/metadata, and the POST aliases of
  the organization, collection, group and member PUT/DELETE routes.
- POST /two-factor/disable (PUT stays).
- ResetMasterPassword, captchaBypassToken, the legacy registration name field,
  userIsManagedByOrganization/managedByOrganization and accessAll.
- The automatic email 2FA code for clients older than 2025.5.0.
- DUO_USE_IFRAME and the Duo Traditional Prompt code.
- Experimental client feature flags that no client reads anymore.
- Web vault CSS selectors for web vaults older than 2025.5.1.

Also accept the PascalCase fields Android 2026.9.0+ sends on registration
and password change, and align a few account, login/2FA and organization
checks with upstream.

Adds tests for the registration body formats.
 2026-10-04 22:16:55 +02:00
Daniel García f4f1a8e105 Send API cleanup: remove legacy endpoints and align access with upstream (#7806) 2026-10-03 23:05:56 +02:00
Daniel García 32098ca7d1 Require confirmed membership for user access checks, not for admin views (#7763) 2026-09-23 23:22:43 +02:00
Daniel García a6c3bd6d18 Update rust docker version (#7689) 2026-09-03 21:17:50 +02:00
Daniel García 46ae59eaf4 Trusted proxy support, unauthenticated rate limit & other fixes (#7472) 
* Trusted proxies, unauthenticated rate limits and various fixes

* Fix get_groups_data

* Fix get_groups_data when not using full_access

* Fmt

* Fix org import

* deduplicate send validation
 2026-07-24 18:27:32 +02:00
Daniel García c3bd1eb565 Fix merge conflict (#7164) 2026-04-29 22:47:42 +02:00
Daniel García c0a78dd55a Use protected CI environment (#7004) 2026-03-23 22:25:03 +01:00
Daniel García 1a1d7f578a Support new desktop origin on CORS (#6920) 2026-03-09 19:14:28 +01:00
Daniel García 3e2cef7e8b Try old refresh token if we fail to decode jwt (#6629) 2025-12-29 22:54:51 +01:00
Daniel García eb2a56aea1 Update lockfile (#6600) 2025-12-28 01:07:17 +01:00
Daniel García a4907f3539 Add wrapped named variants to UserDecryptionOptions (#6598) 2025-12-27 23:35:04 +01:00
Daniel García 5c91058ba0 Add UserDecryptionOptions on /sync too (#6574) 2025-12-20 00:37:46 +01:00
Daniel García 061d320c7f Add new accountKeys and masterPasswordUnlock fields (#6572) 
* Add new accountKeys and masterPasswordUnlock fields

* Fmt
 2025-12-19 13:34:43 +01:00
Daniel García 3cd3d33d00 Improve protected actions (#6411) 
* Improve protected actions

* Match usage on two factor

* Use saturating add

* Don't delete token when tracking attempts
 2025-10-29 21:41:34 +01:00
Daniel García 49eff787de Delete SSO.md (#6152) 
This has been moved over to the wiki: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect
 2025-08-08 23:58:28 +02:00
Daniel García 0755bb19c0 Update release.yml (#6057) 
Seems like docker can't use the hash references: https://github.com/dani-garcia/vaultwarden/actions/runs/16242780267/job/45861396226
 2025-07-13 01:01:08 +02:00
Daniel García a545636ee5 Update flags version and enable manual error reporting (#5994) 2025-06-27 21:39:38 +02:00
Daniel García e7c796a660 Verify templates in CI (#5748) 
* Verify templates in CI

* No need to install packages

* Remove unnecessary fetch depth
 2025-04-04 18:14:19 +02:00
Daniel GarcíaandStefan Melmuk 2a18665288 Implement new registration flow with email verification (#5215) 
* Implement registration with required verified email

* Optional name, emergency access, and signups_allowed

* Implement org invite, remove unneeded invite accept

* fix invitation logic for new registration flow (#5691)

* fix invitation logic for new registration flow

* clarify email_2fa_enforce_on_verified_invite

---------

Co-authored-by: Stefan Melmuk <509385+stefan0xC@users.noreply.github.com>
 2025-03-17 16:28:01 +01:00
Daniel García 2393c3f3c0 Support SSH keys on desktop 2024.12 (#5187) 
* Support SSH keys on desktop 2024.12

* Document flags in .env.template

* Validate key rotation contents
 2024-11-15 18:38:16 +01:00
Daniel García 0d16b38a68 Some more authrequest changes (#5188) 2024-11-15 11:25:51 +01:00
Daniel García 37c14c3c69 More authrequest fixes (#5176) 2024-11-11 20:13:02 +01:00
Daniel García 38aad4f7be Limit HIBP to authed users 2024-11-10 23:59:06 +01:00
Daniel García d184c8f08c Fix keyword collision in Rust 2024 and add new api/config value (#4975) 
* Avoid keyword collision with gen in Rust 2024

* Include new api/config setting to disable user registration, not yet used by clients

* Actually qualify CONFIG
 2024-09-20 21:39:00 +02:00
Daniel García 035f694d2f Improved HTTP client (#4740) 
* Improved HTTP client

* Change config compat to use auto, rename blacklist

* Fix wrong doc references
 2024-07-12 22:33:11 +02:00
Daniel García a4c7fadbf4 Change some missing PascalCase keys (#4671) 2024-06-24 21:17:59 +02:00
Daniel García 4233dbf3db Fix cipher creation on new android app (#4670) 2024-06-24 19:44:06 +02:00
Daniel García a2bf8def2a Change API and structs to camelCase (#4386) 
* Change API inputs/outputs and structs to camelCase

* Fix fields and password history

* Use convert_json_key_lcase_first

* Make sends lowercase

* Update admin and templates

* Update org revoke

* Fix sends expecting size to be a string on mobile

* Convert two-factor providers to string
 2024-06-23 21:31:02 +02:00
Daniel García 8f05a90b96 Fix some more nightly errors and remove lint that will become an error by default (#4661) 2024-06-20 20:25:40 +02:00
Daniel García 9082e7cebb Fix some nightly build errors (#4657) 2024-06-20 09:35:52 +02:00
Daniel García 377969ea67 Update rust and remove unused header values (#4645) 
* Update rust and remove unused header values

* Missed one unused var
 2024-06-16 22:05:17 +02:00
Daniel García 0fe93edea6 Some fixes for the new mobile apps (#4526) 2024-04-27 23:24:04 +02:00
Daniel García 27dc67fadd Implement custom DNS resolver (#3988) 2024-04-27 20:25:34 +02:00
Daniel García 2d98aa3045 Use async verify for Yubikey (#4448) 2024-03-23 16:03:17 +01:00
Daniel García a1fbd6d729 Improve JWT key initialization and avoid saving public key (#4085) 2024-03-17 15:11:20 +01:00
Daniel García 6d73f30b4f Update crates 2024-03-17 14:25:49 +01:00
Daniel GarcíaandBlackDex edf7484a70 Improve file limit handling (#4242) 
* Improve file limit handling

* Oops

* Update PostgreSQL migration

* Review comments

---------

Co-authored-by: BlackDex <black.dex@gmail.com>
 2024-01-27 02:43:26 +01:00
Daniel García ae3a153bdb Update README.md 2024-01-01 19:44:52 +01:00
Daniel García 915496c103 Update web vault to 2023.10.0 2023-11-04 02:55:41 +01:00
Daniel García cb4b683dcd Implement cipher key encryption (#3990) 2023-10-23 00:18:14 +02:00
Daniel García 8933ac2ee7 Merge pull request #3986 from admav/config_email_change 
New config option disable email change
 2023-10-21 17:59:25 +02:00
Daniel García 6822e445bb Merge pull request #3804 from BlackDex/fix-3777 
Fix External ID not set during DC Sync
 2023-10-21 17:58:51 +02:00
Daniel García 18fbc1ccf6 Merge pull request #3909 from tobiasmboelz/reopen-log-file 
Reopen log file on SIGHUP
 2023-10-21 17:58:15 +02:00
Daniel García ff8db4fd78 Merge pull request #3951 from teicee/last-active 
Adds LastActive on /admin/users API route
 2023-10-21 00:21:58 +02:00
Daniel García b2f9af718e Merge pull request #3964 from BlackDex/fix-small-issues 
Fix small issues
 2023-10-21 00:18:21 +02:00
Daniel García 198fd2fc1d Merge pull request #3965 from AndreasHGK/patch-0 
README.md: Fix grammar nit
 2023-10-21 00:17:22 +02:00
Daniel García ec8a9c82df Merge pull request #3981 from teicee/3980-unnecessary-copy 
Remove unnecessary variable clone
 2023-10-21 00:17:00 +02:00
Daniel García 008a2cf298 Merge pull request #3859 from stefan0xC/prevent-handlebar-logs 
filter handlebars logs
 2023-10-08 14:57:23 +02:00
Daniel García f0c9a7fbc3 Merge pull request #3950 from stefan0xC/rename-anonaddy 
csp: rename anonaddy.com to addy.io
 2023-10-08 14:56:18 +02:00
Daniel García 9162b13123 Merge pull request #3959 from tuhanayim/fix-typos 
Fix typos
 2023-10-08 14:55:38 +02:00
Daniel García bc26bfa589 Merge pull request #3911 from BlackDex/fix-arm-build 
Fix arm builds
 2023-09-22 13:48:11 -06:00
Daniel García 99a59bc4f3 Merge pull request #3910 from BlackDex/update-git-workflow 
Update GitHub Workflow
 2023-09-22 13:05:53 -06:00
Daniel García bbd630f1ee Merge pull request #3831 from BlackDex/fix-3819 
Fix Login With Device without MasterPassword
 2023-09-02 14:41:44 +02:00
Daniel García d18b793c71 Merge branch 'main' into fix-3819 2023-09-01 23:39:02 +02:00
Daniel García d3a1d875d5 Merge pull request #3821 from stefan0xC/update-to-v2023.8.2 
update web-vault to v2023.8.2
 2023-09-01 23:37:14 +02:00
Daniel García 5ab7010c37 Fix reference to rust-toolchain.toml in Docker 2023-09-01 00:12:48 +02:00
Daniel García ad2cfd8b97 Merge pull request #3808 from BlackDex/update-rust-and-crates 
Update Rust and Crates
 2023-09-01 00:07:14 +02:00
Daniel García 66bff73ebf Merge pull request #3730 from BlackDex/update-admin-interface 
Update admin interface
 2023-08-31 21:31:10 +02:00
Daniel García f579a4154c Merge pull request #3806 from BlackDex/fix-3776 
Allow Authorization header for Web Sockets
 2023-08-31 20:46:07 +02:00
Daniel García f5a19c5f8b Merge pull request #3797 from stefan0xC/add-plans-all-endpoint 
add new secretsmanager plan for web-v2023.8.x
 2023-08-31 20:37:04 +02:00
Daniel García e9ec3741ae Merge pull request #3573 from BlackDex/update-base-images-and-versions 
Update images to Bookworm and PQ15 and Rust v1.71
 2023-08-12 23:55:14 +02:00
Daniel García dacd50f3f1 Merge pull request #3740 from BlackDex/fix-ldap-import-org-status 
Fix UserOrg status during LDAP Import
 2023-08-12 22:19:20 +02:00
Daniel García 9412112639 Merge pull request #3734 from BlackDex/fix-env-template 
Fix .env.template file
 2023-08-12 22:18:33 +02:00
Daniel García 3dbfc484a5 Merge pull request #3704 from BlackDex/remove-debug-code 
Remove debug code during attachment download
 2023-07-17 18:22:56 +02:00
Daniel García ab65d7989b Merge pull request #3690 from BlackDex/fix-issue-3685 
Fix some external_id issues
 2023-07-14 20:43:51 +02:00
Daniel García 8707728cdb Merge pull request #3686 from GeekCornerGH/feat/add-forwardemail-support 
feat: Add support for forwardemail
 2023-07-14 20:43:32 +02:00
Daniel García 61f9081827 Merge pull request #3678 from BlackDex/fix-org-api-creation-postgres 
Fix Org API Key generation on PosgreSQL
 2023-07-10 17:59:53 +02:00
Daniel García 4826ddca4c Merge pull request #3651 from tessus/fix/branch-on-HEAD 
fix version when compiled at a specific commit
 2023-07-05 18:45:08 +02:00
Daniel García a6cfdddfd8 Merge pull request #3649 from BlackDex/update-crates 
Update crates and small clippy fix
 2023-07-04 20:56:05 +02:00
Daniel García 814ce9a6ac Merge pull request #3632 from sirux88/fix-reset-password-check-issue 
fix missing password check while manual reset password enrollment
 2023-07-04 20:55:34 +02:00
Daniel García 1bee46f64b Merge pull request #3623 from fashberg/main 
Added-External_id for Collections
 2023-07-04 20:54:36 +02:00
Daniel García 556d945396 Merge pull request #3620 from DenuxPlays/main 
Updated docker run command
 2023-07-04 20:54:05 +02:00
Daniel García 664b480c71 Merge pull request #3609 from farodin91/add-user-to-collection-during-creation 
add user to collection during creation
 2023-07-04 20:53:46 +02:00
Daniel García 19e671ff25 Fix dataurl parse panic when icon is malformed 2023-07-03 20:20:26 +02:00
Daniel García 60964c07e6 Add some extra access checks for attachments and groups 2023-07-03 19:58:14 +02:00
Daniel García e7f083dee9 Merge pull request #3593 from GeekCornerGH/feature/store-passkeys-in-the-vault 
feat: Support for storing passkeys in the vault
 2023-06-22 19:06:55 +02:00
Daniel García c56bf38079 Merge pull request #3608 from BlackDex/fix-issue-3607 
Fix send access regression
 2023-06-22 17:58:15 +02:00
Daniel García 2aedff50e8 Merge pull request #3603 from BlackDex/update-crates-and-workflows 
Update crates and workflow
 2023-06-21 23:29:15 +02:00
Daniel García 147c9c7b50 Merge pull request #3505 from gitouche-sur-osm/dockerfile-fqin 
Use fully qualified image names in Dockerfile
 2023-05-08 21:00:30 +02:00
Daniel García 6515a2fcad Merge pull request #3502 from BlackDex/fix-trailing-slash 
Use Rocket `v0.5` branch to fix endpoints
 2023-05-08 21:00:19 +02:00
Daniel García 1ec049e2b5 Update web vault to v2023.4.0 2023-05-01 19:49:48 +02:00
Daniel García 0fb8563b13 Merge pull request #3491 from BlackDex/rocket_changes 
Change `String` to `&str` for all Rocket functions and some other fixes
 2023-04-30 23:53:15 +02:00
Daniel García 393645617e Merge pull request #3469 from BlackDex/rust-and-crate-updates 
Update Rust and Crates
 2023-04-24 18:54:35 +02:00
Daniel García 5bf243b675 Merge pull request #3475 from vilgotf/inline-statics 
inline static rsa keys
 2023-04-24 18:54:19 +02:00
Daniel García 3d7e80a7aa Merge pull request #3440 from BlackDex/switch-ws-to-streams 
Small update to Rocket WebSockets
 2023-04-17 20:26:03 +02:00
Daniel García 5866338de4 Merge pull request #3439 from kennymc-c/main 
Fixed missing footer_text and a few inconsistencies in email templates
 2023-04-17 20:25:36 +02:00
Daniel García 07099df41a Merge pull request #3436 from BlackDex/fix-admin-base-url 
Several config and admin interface fixes
 2023-04-10 21:11:44 +02:00
Daniel García 0c0a80720e Merge pull request #3404 from BlackDex/websockets-via-rocket 
WebSockets via Rocket's Upgrade connection
 2023-04-10 21:10:29 +02:00
Daniel García 3bd4e42fb0 Merge pull request #3427 from stefan0xC/check-if-policies-enabled 
check if reset password policy is enabled
 2023-04-09 19:02:27 +02:00
Daniel García 0b28ab3be1 Merge pull request #3403 from BlackDex/update-dockerfile-and-rust 
Revert setcap, update rust and crates
 2023-04-02 15:39:36 +02:00
Daniel García c5bcc340fa Merge pull request #3405 from BlackDex/fix-multiple-websocket-messages 
Fix sending out multiple websocket notifications
 2023-04-02 15:24:00 +02:00
Daniel García 867c6ba056 Merge pull request #3398 from stefan0xC/dont-expect-kdf-memory-or-parallelism 
always return KdfMemory and KdfParallelism
 2023-04-02 15:22:42 +02:00
Daniel García d1ecf03f44 Merge pull request #3397 from nikolaevn/feature/add-admin-reinvite-endpoint 
support `/users/<uuid>/invite/resend` admin api
 2023-04-02 15:21:51 +02:00
Daniel García 15dd05c78d Merge pull request #3390 from BlackDex/fix-abort-pw-reset-on-mail-error 
Fix abort on pw reset mail error
 2023-04-02 15:19:53 +02:00
Daniel García 525e6bb65a Merge pull request #3376 from jjlin/knowndevices-nopad 
Decode knowndevice `X-Request-Email` as base64url with no padding
 2023-03-27 09:32:25 +02:00
Daniel García 3646f14042 Update web vault to v2023.3.0b 2023-03-26 14:10:51 +02:00
Daniel García 813e889c97 Merge pull request #3366 from BlackDex/some-fixes 
Some small fixes and updates
 2023-03-25 13:31:59 +01:00
Daniel García 5725d297b4 Merge pull request #3363 from BlackDex/gha-test 
Add support for Quay.io and GHCR.io as registries
 2023-03-24 17:11:58 +01:00
Daniel García a428f05e77 Merge pull request #3354 from stefan0xC/bulk-delete-endpoints 
add endpoints to bulk delete collections/groups
 2023-03-24 17:09:56 +01:00