vaultnord.no/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-08-30 23:28:29 +00:00
Code Activity

Fix password change with newer web-vault (#7634)

Browse Source
This commit is contained in:
Mathijs van Veluw
2026-08-24 19:38:23 +02:00
committed by GitHub
parent 46d71107f5
commit fa2566d14f
1 changed files with 31 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/core/accounts.rs
+31 -8
View File
@@ -595,29 +595,52 @@ async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Json
#[serde(rename_all = "camelCase")]
struct ChangePassData {
master_password_hash: String,
new_master_password_hash: String,
master_password_hint: Option<String>,
key: String,
authentication_data: Option<AuthenticationData>,
unlock_data: Option<UnlockData>,
// Outdated values, might still be used by older clients
new_master_password_hash: Option<String>,
key: Option<String>,
}
#[post("/accounts/password", data = "<data>")]
async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
let data: ChangePassData = data.into_inner();
let mut user = headers.user;
let user = headers.user;
if !user.check_valid_password(&data.master_password_hash) {
err!("Invalid password")
}
user.password_hint = clean_password_hint(data.master_password_hint.as_ref());
enforce_password_hint_setting(user.password_hint.as_ref())?;
log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
.await;
let (new_master_password_hash, new_key) =
if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
if authentication_data.kdf != unlock_data.kdf {
err!("KDF settings must be equal for authentication and unlock")
}
if user.email != authentication_data.salt || user.email != unlock_data.salt {
err!("Invalid master password salt")
}
(authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
} else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
(new_master_password_hash, new_key)
} else {
err!("Invalid request!")
};
let mut user = user;
user.password_hint = clean_password_hint(data.master_password_hint.as_ref());
enforce_password_hint_setting(user.password_hint.as_ref())?;
user.set_password(
&data.new_master_password_hash,
Some(data.key),
&new_master_password_hash,
Some(new_key),
true,
Some(vec![
String::from("post_rotatekey"),