MirrorHub/bitwarden_rs
0
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden synced 2024-12-15 01:53:43 +01:00
Code Issues Releases Wiki Activity

2FA org policy: do not enforce on invited (not accepted) users

Browse source
This commit is contained in:
Adam Jones 2021-10-09 13:54:30 +01:00
parent 44da9e6ca7
commit a984dbbdf3
No known key found for this signature in database
GPG key ID: B3D3399C05B09A00
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/api/core/organizations.rs
View file

@ -1230,20 +1230,22 @@ fn put_policy(
None => err!("Invalid policy type"), None => err!("Invalid policy type"),
}; };
// If enabling the TwoFactorAuthentication policy, remove this org's members that do have 2FA
if pol_type_enum == OrgPolicyType::TwoFactorAuthentication && data.enabled { if pol_type_enum == OrgPolicyType::TwoFactorAuthentication && data.enabled {
let org_list = UserOrganization::find_by_org(&org_id, &conn); let org_members = UserOrganization::find_by_org(&org_id, &conn);
for user_org in org_list.into_iter() { for member in org_members.into_iter() {
let user_twofactor_disabled = TwoFactor::find_by_user(&user_org.user_uuid, &conn).is_empty(); let user_twofactor_disabled = TwoFactor::find_by_user(&member.user_uuid, &conn).is_empty();
if user_twofactor_disabled && user_org.atype < UserOrgType::Admin { // Policy only applies to non-Owner/non-Admin members who have accepted joining the org
if user_twofactor_disabled && member.atype < UserOrgType::Admin && member.status != UserOrgStatus::Invited as i32 {
if CONFIG.mail_enabled() { if CONFIG.mail_enabled() {
let org = Organization::find_by_uuid(&user_org.org_uuid, &conn).unwrap(); let org = Organization::find_by_uuid(&member.org_uuid, &conn).unwrap();
let user = User::find_by_uuid(&user_org.user_uuid, &conn).unwrap(); let user = User::find_by_uuid(&member.user_uuid, &conn).unwrap();
mail::send_2fa_removed_from_org(&user.email, &org.name)?; mail::send_2fa_removed_from_org(&user.email, &org.name)?;
} }
user_org.delete(&conn)?; member.delete(&conn)?;
} }
} }
} }