MirrorHub/bitwarden_rs
0
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden synced 2024-12-13 17:22:58 +01:00
Code Issues Releases Wiki Activity

Trim spaces from admin token during authentication and validate that the admin panel token is not empty

Browse source
This commit is contained in:
Daniel García 2019-03-07 20:21:50 +01:00
parent 9e1f030a80
commit 0718a090e1
No known key found for this signature in database
GPG key ID: FC8A7D14C3CD543A
2 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/api/admin.rs
View file

@ -89,7 +89,7 @@ fn post_admin_login(data: Form<LoginForm>, mut cookies: Cookies, ip: ClientIp) -
fn _validate_token(token: &str) -> bool {
match CONFIG.admin_token().as_ref() {
None => false,
Some(t) => crate::crypto::ct_eq(t, token),
Some(t) => crate::crypto::ct_eq(t.trim(), token.trim()),
}
}

6
src/config.rs
View file

@ -317,6 +317,12 @@ make_config! {
}
fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
if let Some(ref token) = cfg.admin_token {
if token.trim().is_empty() {
err!("`ADMIN_TOKEN` is enabled but has an empty value. To enable the admin page without token, use `DISABLE_ADMIN_TOKEN`")
}
}
if cfg.yubico_client_id.is_some() != cfg.yubico_secret_key.is_some() {
err!("Both `YUBICO_CLIENT_ID` and `YUBICO_SECRET_KEY` need to be set for Yubikey OTP support")
}