[PR #1219] [MERGED] Ensure that a user is actually in an org when applying policies #2780

New Issue

Closed

opened 2025-11-07 07:54:36 -06:00 by GiteaMirror · 0 comments

GiteaMirror commented 2025-11-07 07:54:36 -06:00

Owner

Copy Link

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/1219
Author: @aveao
Created: 11/7/2020
Status: ✅ Merged
Merged: 11/7/2020
Merged by: @dani-garcia

Base: master ← Head: master

---

📝 Commits (1)

• fa364c3 Ensure that a user is actually in an org when applying policies

📊 Changes

1 file changed (+4 additions, -1 deletions)

View changed files

📝 src/db/models/org_policy.rs (+4 -1)

📄 Description

While this patch (which is based on src/db/models/collection.rs's find_by_user_uuid) was initially to fix #1218, you already pushed 013d4c28b2 just as I was making the PR.

There's however one case that doesn't seem to account that is fixed by this PR: User B (owner of Org A) can invite User A to Org A, and even if User A doesn't accept this invitation, the policies will be applied to them:

I've tested this behavior with and without this patch, verified that that behavior happens, and that this PR resolves that issue.

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/1219 **Author:** [@aveao](https://github.com/aveao) **Created:** 11/7/2020 **Status:** ✅ Merged **Merged:** 11/7/2020 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`fa364c3`](https://github.com/dani-garcia/vaultwarden/commit/fa364c3f2ce47ab78f970d1fa27ffe6c11d0545d) Ensure that a user is actually in an org when applying policies ### 📊 Changes **1 file changed** (+4 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/db/models/org_policy.rs` (+4 -1) </details> ### 📄 Description While this patch (which is based on src/db/models/collection.rs's find_by_user_uuid) was initially to fix #1218, you already pushed https://github.com/dani-garcia/bitwarden_rs/commit/013d4c28b2e06dc654b7f2a1f21b56b1c8a7838d just as I was making the PR. There's however one case that doesn't seem to account that is fixed by this PR: User B (owner of Org A) can invite User A to Org A, and even if User A doesn't accept this invitation, the policies will be applied to them:   I've tested this behavior with and without this patch, verified that that behavior happens, and that this PR resolves that issue. --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

GiteaMirror added the pull-request label 2025-11-07 07:54:36 -06:00

GiteaMirror closed this issue 2025-11-07 07:54:36 -06:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

cached-config-operations

test_dylint

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

wontfix

No Label pull-request

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

GiteaMirror ninjasurge

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#2780