Skip to content

Commit

Permalink
Validate all needed fields for client API login
Browse files Browse the repository at this point in the history
During the client API login we need to have a `device_identifier`, `device_name` and `device_type`.
When these were not provided Vaultwarden would panic.

This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.
  • Loading branch information
BlackDex authored and dani-garcia committed Feb 21, 2023
1 parent 5c859e2 commit f95f40b
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions src/api/identity.rs
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,10 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, mut conn:
_check_is_some(&data.client_secret, "client_secret cannot be blank")?;
_check_is_some(&data.scope, "scope cannot be blank")?;

_check_is_some(&data.device_identifier, "device_identifier cannot be blank")?;
_check_is_some(&data.device_name, "device_name cannot be blank")?;
_check_is_some(&data.device_type, "device_type cannot be blank")?;

_api_key_login(data, &mut user_uuid, &mut conn, &ip).await
}
t => err!("Invalid type", t),
Expand Down

0 comments on commit f95f40b

Please sign in to comment.