Add missing Headers parameter for some functions This allowed any request from allowing these endpoints by not validating the user correctly.
Changed the functions to retreive the emergency access record by using the user uuid which calls the endpoint, instead of validating afterwards. This is more secure and prevents the need of an if check.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/4715
**Author:** [@BlackDex](https://github.com/BlackDex)
**Created:** 7/8/2024
**Status:** ✅ Merged
**Merged:** 7/8/2024
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `ea_fixes`
---
### 📝 Commits (1)
- [`c1a01b6`](https://github.com/dani-garcia/vaultwarden/commit/c1a01b6bc0588432d02e0f11e9129068791280c7) Some fixes for emergency access
### 📊 Changes
**3 files changed** (+116 additions, -95 deletions)
<details>
<summary>View changed files</summary>
📝 `src/api/core/accounts.rs` (+6 -9)
📝 `src/api/core/emergency_access.rs` (+90 -77)
📝 `src/db/models/emergency_access.rs` (+20 -9)
</details>
### 📄 Description
- Add missing `Headers` parameter for some functions This allowed any request from allowing these endpoints by not validating the user correctly.
- Changed the functions to retreive the emergency access record by using the user uuid which calls the endpoint, instead of validating afterwards. This is more secure and prevents the need of an if check.
Fixes https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39924
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/4715
Author: @BlackDex
Created: 7/8/2024
Status: ✅ Merged
Merged: 7/8/2024
Merged by: @dani-garcia
Base:
main← Head:ea_fixes📝 Commits (1)
c1a01b6Some fixes for emergency access📊 Changes
3 files changed (+116 additions, -95 deletions)
View changed files
📝
src/api/core/accounts.rs(+6 -9)📝
src/api/core/emergency_access.rs(+90 -77)📝
src/db/models/emergency_access.rs(+20 -9)📄 Description
Headersparameter for some functions This allowed any request from allowing these endpoints by not validating the user correctly.Fixes https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39924
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.