hacktoberfestdockervaultwardenrustrocketbitwarden-rsbitwarden

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tree: b571efcadd

cached-config-operations

main

revert-7033-patch-1

test_dylint

0.10.0

0.11.0

0.12.0

0.13.0

0.9.0

1.0.0

1.1.0

1.10.0

1.11.0

1.12.0

1.13.0

1.13.1

1.14

1.14.1

1.14.2

1.15.0

1.15.1

1.16.0

1.16.1

1.16.2

1.16.3

1.17.0

1.18.0

1.19.0

1.2.0

1.20.0

1.21.0

1.22.0

1.22.1

1.22.2

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.25.2

1.26.0

1.27.0

1.28.0

1.28.1

1.29.0

1.29.1

1.29.2

1.3.0

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.32.6

1.32.7

1.33.0

1.33.1

1.33.2

1.34.0

1.34.1

1.34.2

1.34.3

1.35.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.36.0

1.37.0

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.9.0

1.9.1

Branches Tags

${ item.name }

Create tag ${ searchTerm }

Create branch ${ searchTerm }

from 'b571efcadd'

${ noResults }

vaultwarden/src/api

History

tom27052006 8a65c6631a Security: gate group delete/member-removal on collection access A Custom member with only the manage_groups permission could revoke other members' collection access via two endpoints that were missing the collection-access check enforced elsewhere (put_group_members, edit_member): - POST /organizations/<org>/groups/<group>/delete-user/<member> (post_delete_group_member) removed a member from any group, including collection-bearing ones. - DELETE /organizations/<org>/groups/<group> and its bulk variant (delete_group_impl / bulk_delete_groups) deleted collection-bearing groups outright, revoking access for all their members. Neither path can grant access, so confidentiality was never at risk, but both let a manage_groups-only user tamper with other members' collection access, contradicting the permission's invariant. Both now require Admin/Owner or full collection access before touching a group that confers collection access (via access_all or assigned collections).		2 weeks ago
..
core	Security: gate group delete/member-removal on collection access	2 weeks ago
admin.rs	Harden custom-role permission checks	2 weeks ago
icons.rs	Fix enforce blocked (#7246)	2 weeks ago
identity.rs	2026.6.0 send support (#7346)	2 weeks ago
mod.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
notifications.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
push.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
web.rs	Serve Apple app site association file (#7191)	2 months ago