mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-06-16 07:11:04 +03:00
Mathijs van Veluw
d297e274a3
* Ensure SSO token is only usable on the same client This commit adds an extra check via cookies to ensure the same browser/client is used to request and provide the SSO token. Previously it would be able to provide a custom link which attackers could use to steal data. While an attacker would still need the Master Password to be able to decrypt or execute specific actions, they were able to fetch encrypted data. Solved with some help of Claude Code. Signed-off-by: BlackDex <black.dex@gmail.com> * Check email-verified on SSO login/create This commit prevents possible account takeover via SSO which doesn't check/validate or provide validated status of the email. It was checked at other locations, but was skipped here. Signed-off-by: BlackDex <black.dex@gmail.com> * Prevent data disclosure via SSO endpoints This commit prevents some data disclosure and user enumeration by only returning the fake SSO identifier. Since we do not check the identifier anywhere useful, returning the fake one is just fine. During an invite to an org, that link contains the correct UUID and will be used for the master password requirements. For anything else, server admins should set the `SSO_MASTER_PASSWORD_POLICY` env variable. Signed-off-by: BlackDex <black.dex@gmail.com> * Adjust admin layout to fix issues when SSO is enabled Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>
122 lines
6.5 KiB
Handlebars
122 lines
6.5 KiB
Handlebars
<!DOCTYPE html>
|
|
<html lang="en" data-bs-theme="auto">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<meta name="robots" content="noindex,nofollow" />
|
|
<link rel="icon" type="image/png" href="{{urlpath}}/vw_static/vaultwarden-favicon.png">
|
|
<title>Vaultwarden Admin Panel</title>
|
|
<link rel="stylesheet" href="{{urlpath}}/vw_static/bootstrap.css" />
|
|
<link rel="stylesheet" href="{{urlpath}}/vw_static/admin.css" />
|
|
<script src="{{urlpath}}/vw_static/admin.js"></script>
|
|
</head>
|
|
<body>
|
|
<svg xmlns="http://www.w3.org/2000/svg" class="d-none">
|
|
<symbol id="vw-icon-sun" viewBox="0 0 24 24">
|
|
<circle cx="12" cy="12" r="5" fill="currentColor"/>
|
|
<g stroke="currentColor" stroke-linecap="round" stroke-width="1.5">
|
|
<path d="M12 2v3M12 19v3M4.22 4.22l2.12 2.12M17.66 17.66l2.12 2.12M2 12h3M19 12h3M4.22 19.78l2.12-2.12M17.66 6.34l2.12-2.12"/>
|
|
</g>
|
|
</symbol>
|
|
<symbol id="vw-icon-moon" viewBox="0 0 24 24">
|
|
<path fill="currentColor" stroke-width=".8" d="M18.4 17.8A9 8.6 0 0 1 13 2a10.5 10 0 1 0 9 14.4 9.4 9 0 0 1-3.6 1.4"/>
|
|
</symbol>
|
|
<symbol id="vw-icon-auto" viewBox="0 0 24 24">
|
|
<circle cx="12" cy="12" r="9" fill="none" stroke="currentColor" stroke-width="1.5"/>
|
|
<path fill="currentColor" d="M12 3a9 9 0 1 1 0 18Z"/>
|
|
</symbol>
|
|
</svg>
|
|
<nav class="navbar navbar-expand-md navbar-dark bg-dark mb-4 shadow fixed-top">
|
|
<div class="container-xxl">
|
|
<a class="navbar-brand" href="{{urlpath}}/admin"><img class="vaultwarden-icon" src="{{urlpath}}/vw_static/vaultwarden-icon.png" alt="V">aultwarden Admin</a>
|
|
<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"
|
|
aria-controls="navbarCollapse" aria-expanded="false" aria-label="Toggle navigation">
|
|
<span class="navbar-toggler-icon"></span>
|
|
</button>
|
|
<div class="collapse navbar-collapse" id="navbarCollapse">
|
|
<ul class="navbar-nav me-auto">
|
|
{{#if logged_in}}
|
|
<li class="nav-item">
|
|
<a class="nav-link" href="{{urlpath}}/admin">Settings</a>
|
|
</li>
|
|
<li class="nav-item">
|
|
<a class="nav-link" href="{{urlpath}}/admin/users/overview">Users</a>
|
|
</li>
|
|
<li class="nav-item">
|
|
<a class="nav-link" href="{{urlpath}}/admin/organizations/overview">Organizations</a>
|
|
</li>
|
|
<li class="nav-item">
|
|
<a class="nav-link" href="{{urlpath}}/admin/diagnostics">Diagnostics</a>
|
|
</li>
|
|
{{/if}}
|
|
<li class="nav-item">
|
|
<a class="nav-link" href="{{urlpath}}/" target="_blank" rel="noreferrer">Vault</a>
|
|
</li>
|
|
</ul>
|
|
|
|
<ul class="navbar-nav mx-3">
|
|
<li class="nav-item dropdown">
|
|
<button
|
|
class="btn btn-link nav-link py-0 px-0 px-md-2 dropdown-toggle d-flex align-items-center"
|
|
id="bd-theme" type="button" aria-expanded="false" data-bs-toggle="dropdown"
|
|
data-bs-display="static" aria-label="Toggle theme (auto)">
|
|
<span class="my-1 fs-4 theme-icon-active">
|
|
<svg class="vw-theme-icon" focusable="false" aria-hidden="true">
|
|
<use data-theme-icon-use href="#vw-icon-auto"></use>
|
|
</svg>
|
|
</span>
|
|
<span class="d-md-none ms-2" id="bd-theme-text">Toggle theme</span>
|
|
</button>
|
|
<ul class="dropdown-menu dropdown-menu-end" aria-labelledby="bd-theme-text">
|
|
<li>
|
|
<button type="button" class="dropdown-item d-flex align-items-center"
|
|
data-bs-theme-value="light" aria-pressed="false">
|
|
<span class="me-2 fs-4 theme-icon">
|
|
<svg class="vw-theme-icon" focusable="false" aria-hidden="true">
|
|
<use data-theme-icon-use href="#vw-icon-sun"></use>
|
|
</svg>
|
|
</span>
|
|
Light
|
|
</button>
|
|
</li>
|
|
<li>
|
|
<button type="button" class="dropdown-item d-flex align-items-center"
|
|
data-bs-theme-value="dark" aria-pressed="false">
|
|
<span class="me-2 fs-4 theme-icon">
|
|
<svg class="vw-theme-icon" focusable="false" aria-hidden="true">
|
|
<use data-theme-icon-use href="#vw-icon-moon"></use>
|
|
</svg>
|
|
</span>
|
|
Dark
|
|
</button>
|
|
</li>
|
|
<li>
|
|
<button type="button" class="dropdown-item d-flex align-items-center active"
|
|
data-bs-theme-value="auto" aria-pressed="true">
|
|
<span class="me-2 fs-4 theme-icon">
|
|
<svg class="vw-theme-icon" focusable="false" aria-hidden="true">
|
|
<use data-theme-icon-use href="#vw-icon-auto"></use>
|
|
</svg>
|
|
</span>
|
|
Auto
|
|
</button>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
|
|
{{#if logged_in}}
|
|
<a class="btn btn-sm btn-secondary" href="{{urlpath}}/admin/logout">Log Out</a>
|
|
{{/if}}
|
|
|
|
</div>
|
|
</div>
|
|
</nav>
|
|
|
|
{{> (lookup this "page_content") }}
|
|
|
|
<!-- This script needs to be at the bottom, else it will fail! -->
|
|
<script src="{{urlpath}}/vw_static/bootstrap.bundle.js"></script>
|
|
</body>
|
|
</html>
|