3f6809bcdf
Fixed issue/request #705
...
Added a config option to disable time drifted totp codes.
Default is false, since this is what the RFC recommends.
2019-11-07 17:11:29 +01:00
c52adef919
Added configurable smtp timeout.
...
- Added config option for smtp timeout
- Lowered default timeout to 15 seconds instead of default 60.
2019-11-06 21:39:33 +01:00
2ffc3eac4d
Clippy fix
2019-11-06 20:34:52 +01:00
0ff7fd939e
Next attempt for issue #709 fix
...
Now creates icon cache directory at startup.
And it also creates the directory if it went missing during runtime.
Also modified the icon_save/mark_negcache to be one.
2019-11-06 20:21:47 +01:00
ca7c5129b2
Fixed issue #709 creating icon_cache directory.
...
When the icon_cache directory doesn't exists yet, and the first icon
catched is a miss this .miss file was not able to be created since the
directory was only created during a valid icon download.
2019-11-06 15:47:56 +01:00
b4dfc24040
Merge pull request #703 from patrickli/bugfix/dont-sync-excluded-global-domains
...
Don't include excluded global equivalent domains during sync
2019-11-05 18:47:43 +01:00
85dbf4e16c
Don't include excluded global equivalent domains during sync
...
Fixes #681
2019-11-05 21:29:04 +13:00
3442eb1b9d
Trying to fix issue #687
...
- Using an older commit from rocket repo
2019-11-04 14:30:24 +01:00
e449912f05
Generate recovery codes for email and duo
2019-11-02 18:31:50 +01:00
d29b6bee28
Remove unnecessary clones and other clippy fixes
2019-11-02 17:39:01 +01:00
00a11b1b78
Stop leaking usernames when SIGNUPS_ALLOWED=false
...
This fixes #691 - respond in less specific way to not leak the
fact that user is already registered on the server.
2019-11-01 22:34:42 +00:00
ee550be80c
Added http favicon url when response failed
2019-10-29 14:24:01 +01:00
fccc0a4b05
Update rocket to latest master
...
Downgrade rust version to fix cargo issue
Set rustup profile to minimal
2019-10-25 21:48:10 +02:00
ebc47dc161
Remove unneeded WS logging
2019-10-17 17:15:11 +02:00
3b7a5bd102
Move 2FA email config to after SMTP config
2019-10-16 07:11:16 +02:00
2edecf34ff
Use user_uuid instead of mut twofactor
2019-10-15 21:20:19 +02:00
18bc8331f9
Send email when preparing 2FA JsonError
2019-10-15 21:19:49 +02:00
603a964579
Fixed issue #663 .
...
During the 2fa activation there is no twofactor record yet.
Changed the layout a bit so that it will generate a new twofactor record
when it does not exists yet. Else it will just update the already
existing record.
2019-10-14 00:32:44 +02:00
dc515b83f3
Merge pull request #657 from BlackDex/totp-timedrift
...
Updated authenticator TOTP
2019-10-12 16:33:43 +02:00
9466f02696
Recoded TOTP time drift validation
2019-10-12 15:28:28 +02:00
2cde814aaa
Fixed a bug with the sqlite backup feature.
...
When a custom path is used the backup feature does not work.
Changed it so it will take the path of the sqlite file and use that.
2019-10-11 12:08:40 +02:00
d989a19f76
Merge branch 'master' of https://github.com/dani-garcia/bitwarden_rs into totp-timedrift
2019-10-11 11:22:13 +02:00
d292269ea0
Make the blacklist logic be cached
2019-10-10 23:21:22 +02:00
ebf40099f2
Updated authenticator TOTP
...
- Added security check for previouse used codes
- Allow TOTP codes with 1 step back and forward when there is a time
drift. This means in total 3 codes could be valid. But only newer codes
then the previouse used codes are excepted after that.
2019-10-10 17:32:20 +02:00
edc482c8ea
Changed HIBP Error message.
...
- Moved the manual link to the check to the top.
- Clearified that hibp is a payed service.
- Changed error logo to hibp logo.
2019-10-08 22:29:12 +02:00
6e5c03cc78
Some modification when no HIBP API Key is set
...
- Added an URL with the useraccount for manual check.
- Added support for HTTP(S)_PROXY for hibp.
2019-10-08 21:39:11 +02:00
881c1978eb
Error when the URL scheme doesn't match the database type
2019-10-08 19:34:47 +02:00
662bc27523
Updated dependencies and fixed disable_admin_token description
2019-10-08 19:33:27 +02:00
e6b763026e
Merge branch 'master' into icon-security
2019-10-05 16:45:36 +02:00
c182583e09
Merge pull request #644 from BlackDex/issue-565
...
Fixed issue #565
2019-10-05 16:17:43 +02:00
d821389c2e
Merge pull request #639 from vverst/cors-update
...
Change CORS headers
2019-10-05 16:09:33 +02:00
be2916333b
Fixed issue #565
...
Issue fixed by omitting the cookie header when cookie_str is empty
2019-10-05 15:45:09 +02:00
9124d8a3fb
Updated icon blacklisting.
...
- Blacklisting was not effective for redirects and rel href
- Able to blacklist non global IP's like RFC1918, multicast etc...
2019-10-05 14:48:15 +02:00
7b1da527a6
Change CORS headers
...
Only add Allow-Origin to all requests and move the others to preflight OPTIONS request.
If Origin is `file://` change it to the wildcard.
2019-10-01 20:12:33 +02:00
d6e9af909b
Remove the unnecessary check for sqlite
...
The binary we use is called `sqlite3` so no need to check for other
name variants as we won't use those anyways.
2019-10-01 10:40:22 +01:00
acdd42935b
Add sqlite binary into the docker images
...
This is done to enable backup functionality in the admin interface while
we're waiting for the libsqlite-sys 0.17 to bubble up in the upstream
dependencies. Then we can start using `VACUUM INTO`
This also extends the check for the sqlite binary to also try `sqlite3`
as this is the name of the binary in baseimage distributions we use.
2019-09-30 13:54:06 +01:00
56f12dc982
Use Access-Control-Allow-Method
2019-09-23 07:44:44 +02:00
4c07f05b3a
Remove Result<T, E: Debug> in preparation of deprecation as Rocket responder.
...
Removed unnecessary returns
2019-09-17 21:05:56 +02:00
f5f9861a78
Adds support for PostgreSQL which resolves #87 and is mentioned in #246 .
...
This includes migrations as well as Dockerfile's for amd64.
The biggest change is that replace_into isn't supported by Diesel for the
PostgreSQL backend, instead requiring the use of on_conflict. This
unfortunately requires a branch for save() on all of the models currently
using replace_into.
2019-09-12 16:12:22 -04:00
df8114f8be
Updated client kdf iterations to 100000 and fixed some lints
2019-09-05 21:56:12 +02:00
5a2f968d7a
Set correct response headers, status code
2019-09-02 21:13:12 +02:00
16d88402cb
Initial version of CORS support
2019-09-01 13:00:12 +02:00
7dcf18151d
Fix onsubmit
2019-08-31 17:57:47 +02:00
e3404dd322
Use the local scripts instead of cloudflare, remove jquery and update config so disabling a master toggle doesn't remove the values
2019-08-31 17:47:52 +02:00
bfc517ee80
Remove unused warning
2019-08-31 17:26:16 +02:00
4a7d2a1e28
Rename static files endpoint
2019-08-31 17:25:31 +02:00
c07c9995ea
Merge pull request #555 from vverst/email-codes
...
Add Email 2FA login
2019-08-27 21:07:41 +02:00
672a245548
Remove unecessary clone
2019-08-27 10:40:38 -07:00
5d50b1ee3c
Merge remote-tracking branch 'upstream/master' into email-codes
2019-08-26 21:38:45 +02:00
c99df1c310
Compare token using crypto::ct_eq
2019-08-26 20:26:59 +02:00
BlackDex
Daniel García
Patrick Li
Miro Prasil
Jellyfrog
vpl
Michael Powers
ViViDboarder