hacktoberfestdockervaultwardenrustrocketbitwarden-rsbitwarden

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tree: b1473be414

cached-config-operations

main

revert-7033-patch-1

test_dylint

v2-registration

0.10.0

0.11.0

0.12.0

0.13.0

0.9.0

1.0.0

1.1.0

1.10.0

1.11.0

1.12.0

1.13.0

1.13.1

1.14

1.14.1

1.14.2

1.15.0

1.15.1

1.16.0

1.16.1

1.16.2

1.16.3

1.17.0

1.18.0

1.19.0

1.2.0

1.20.0

1.21.0

1.22.0

1.22.1

1.22.2

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.25.2

1.26.0

1.27.0

1.28.0

1.28.1

1.29.0

1.29.1

1.29.2

1.3.0

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.32.6

1.32.7

1.33.0

1.33.1

1.33.2

1.34.0

1.34.1

1.34.2

1.34.3

1.35.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.36.0

1.37.0

1.37.1

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.9.0

1.9.1

Branches Tags

${ item.name }

Create tag ${ searchTerm }

Create branch ${ searchTerm }

from 'b1473be414'

${ noResults }

vaultwarden/scripts

History

Rune Darrud b1473be414 Harden the Public API member and group write endpoints Adversarial review of the new endpoints turned up several defects. Ownership is now out of reach of a Public API client. The internal endpoints only let an Owner grant, change or remove Owner, and that check cannot be applied here because there is no user behind the request. Since the organization API key can be created by an Admin, a client could previously promote itself to Owner and take over the organization. Granting the Owner role and acting on an existing owner are both refused now, which subsumes the narrower last confirmed owner guard. An omitted groups list on a member update no longer unassigns every group. Upstream leaves group access untouched when the field is absent and only collections reset on omission, so groups is optional now. An omitted accessAll on a group update no longer clears the flag, and an omitted externalId no longer clears the directory matching key that /public/organization/import relies on to match members and groups. Revoked members are reported with the upstream status of -1 instead of the internal offset encoding, matching every other serializer in the codebase. Restore refuses a member who is not revoked, rather than saving nothing and logging a restore that did not happen, and group creation is logged before its collection associations so a failure cannot leave an unaudited group. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		5 days ago
..
smoke_public_api.sh	Add smoke test for the organization Public API read endpoints	5 days ago
smoke_public_api_write.sh	Harden the Public API member and group write endpoints	5 days ago