vividboarder/bitwarden_rs
1
0
Fork 0
mirror of https://github.com/ViViDboarder/bitwarden_rs.git synced 2024-11-22 05:06:37 +00:00
Code Issues Releases Wiki Activity

Make org owner invitations respect the email domain whitelist

Browse Source 
This closes a loophole where org owners can invite new users from any domain.
This commit is contained in:
Jeremy Lin 2020-04-09 01:51:05 -07:00
parent c2a324e5da
commit e4d08836e2
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/api/core/organizations.rs
View File

@ -485,7 +485,11 @@ fn send_invite(org_id: String, data: JsonUpcase<InviteData>, headers: AdminHeade
let user = match User::find_by_mail(&email, &conn) { let user = match User::find_by_mail(&email, &conn) {
None => { None => {
if !CONFIG.invitations_allowed() { if !CONFIG.invitations_allowed() {
err!(format!("User email does not exist: {}", email)) err!(format!("User does not exist: {}", email))
}
if !CONFIG.signups_domains_whitelist().is_empty() && !CONFIG.is_email_domain_whitelisted(&email) {
err!("Email domain not eligible for invitations")
} }
if !CONFIG.mail_enabled() { if !CONFIG.mail_enabled() {
@ -978,4 +982,4 @@ fn put_policy(org_id: String, pol_type: i32, data: Json<PolicyData>, _headers: A
policy.save(&conn)?; policy.save(&conn)?;
Ok(Json(policy.to_json())) Ok(Json(policy.to_json()))
} }