We also fixed a security issue with groups. Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid. The organization uuid was not used in the query or validated with the group. This is now fixed including some other parts where i changed the checks to be more strict.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/5291
**Author:** [@BlackDex](https://github.com/BlackDex)
**Created:** 12/13/2024
**Status:** ✅ Merged
**Merged:** 12/13/2024
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `general-fixes`
---
### 📝 Commits (1)
- [`bec475d`](https://github.com/dani-garcia/vaultwarden/commit/bec475d5d816653d4b3bea52ed5ff3cc2e2d1a8e) Some refactoring and optimizations
### 📊 Changes
**23 files changed** (+414 additions, -594 deletions)
<details>
<summary>View changed files</summary>
📝 `Cargo.lock` (+18 -18)
📝 `src/api/admin.rs` (+7 -8)
📝 `src/api/core/accounts.rs` (+38 -58)
📝 `src/api/core/ciphers.rs` (+39 -65)
📝 `src/api/core/emergency_access.rs` (+79 -91)
📝 `src/api/core/folders.rs` (+7 -23)
📝 `src/api/core/organizations.rs` (+116 -180)
📝 `src/api/core/public.rs` (+6 -9)
📝 `src/api/core/sends.rs` (+21 -48)
📝 `src/api/core/two_factor/authenticator.rs` (+2 -3)
📝 `src/api/core/two_factor/duo.rs` (+6 -9)
📝 `src/api/core/two_factor/email.rs` (+7 -10)
📝 `src/api/core/two_factor/mod.rs` (+2 -3)
📝 `src/api/core/two_factor/webauthn.rs` (+7 -8)
📝 `src/api/identity.rs` (+16 -22)
📝 `src/api/push.rs` (+3 -6)
📝 `src/auth.rs` (+8 -12)
📝 `src/db/models/auth_request.rs` (+11 -0)
📝 `src/db/models/folder.rs` (+2 -1)
📝 `src/db/models/group.rs` (+2 -1)
_...and 3 more files_
</details>
### 📄 Description
- Refactored several code to use more modern syntax
- Made some checks a bit more strict
- Updated crates
We also fixed a security issue with groups. Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid. The organization uuid was not used in the query or validated with the group. This is now fixed including some other parts where i changed the checks to be more strict.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/5291
Author: @BlackDex
Created: 12/13/2024
Status: ✅ Merged
Merged: 12/13/2024
Merged by: @dani-garcia
Base:
main← Head:general-fixes📝 Commits (1)
bec475dSome refactoring and optimizations📊 Changes
23 files changed (+414 additions, -594 deletions)
View changed files
📝
Cargo.lock(+18 -18)📝
src/api/admin.rs(+7 -8)📝
src/api/core/accounts.rs(+38 -58)📝
src/api/core/ciphers.rs(+39 -65)📝
src/api/core/emergency_access.rs(+79 -91)📝
src/api/core/folders.rs(+7 -23)📝
src/api/core/organizations.rs(+116 -180)📝
src/api/core/public.rs(+6 -9)📝
src/api/core/sends.rs(+21 -48)📝
src/api/core/two_factor/authenticator.rs(+2 -3)📝
src/api/core/two_factor/duo.rs(+6 -9)📝
src/api/core/two_factor/email.rs(+7 -10)📝
src/api/core/two_factor/mod.rs(+2 -3)📝
src/api/core/two_factor/webauthn.rs(+7 -8)📝
src/api/identity.rs(+16 -22)📝
src/api/push.rs(+3 -6)📝
src/auth.rs(+8 -12)📝
src/db/models/auth_request.rs(+11 -0)📝
src/db/models/folder.rs(+2 -1)📝
src/db/models/group.rs(+2 -1)...and 3 more files
📄 Description
We also fixed a security issue with groups. Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid. The organization uuid was not used in the query or validated with the group. This is now fixed including some other parts where i changed the checks to be more strict.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.