Vaultwarphpen 0.1.3

Changes since 0.1.2

Security fixes from a second internal review. Updating is recommended.
docs/security-review.md
describes each finding (9 to 15).

• No routes below /index.php/. Every route also answered with the script name in front of it, for
  example /index.php/admin, so a web server rule that keeps /admin to some addresses did not apply.
  Such paths now get a 404, as in Vaultwarden.
• Notifications daemon: one request with more query fields than PHP's max_input_vars ended the
  daemon and every live connection. It now parses the query itself.
• Settings: saving them in the admin panel rewrote config.json in place, and requests in between ran
  without it. The file is now replaced in one step and keeps its permissions.
• Request bodies are limited like Vaultwarden's: JSON up to 20 MB, forms up to 32 KiB, 413 above that.
• Method override only Rocket's way, through a leading _method form field; the query string and the
  X-HTTP-Method-Override header no longer change the method.
• Tokens: a wrong admin token against an Argon2 hash is verified once instead of twice, and token
  signatures are only accepted in their canonical base64url spelling.
• Installation guide: set display_errors = Off and a small max_file_uploads in PHP, and limit
  request bodies in the web server (LimitRequestBody for Apache), since PHP stores the files of any
  upload request before Vaultwarphpen sees it.
• Tests: the end-to-end tests with the official clients also log in with SSO.

As since 0.1.2, PHP 8.5.12 or newer is required.

Downloads

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check vaultwarphpen-0.1.3.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

Full Changelog: v0.1.2...v0.1.3

Vaultwarphpen 0.1.2

Changes since 0.1.1

• Vaultwarden's fixes after 1.37.4: Vaultwarphpen now follows Vaultwarden commit
  64ae55c
  and ports its three changes:
  • The v2 API checks the storage limit when it reserves an attachment. Before, reservations alone could
    use up the quota of a user or an organization.
  • Updating a cipher cannot move it into an organization; only sharing can. The /admin routes take
    organization ciphers only. Sharing needs an organization and at least one collection. A personal
    import ignores organization IDs.
  • The clients hear about a new attachment when it is reserved, not again after the upload.
• PHP 8.5.12 or newer is required. It fixes heap buffer overflows in the URL parser that the HTTP
  client and the icon service use for addresses from outside. Update PHP before you update
  Vaultwarphpen: Composer's platform check refuses older releases.
• Dependencies: Laravel 13.39, Symfony 8.1.10; PHPUnit 13 for the tests.

Downloads

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check vaultwarphpen-0.1.2.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

Full Changelog: v0.1.1...v0.1.2

Vaultwarphpen 0.1.1

Changes since 0.1.0

• Notifications daemon: it now stays within its memory and file descriptors under load. Frames,
  requests, connections and unsent output are limited, so a few clients can no longer take it past
  memory_limit (security review).
• Local times in the admin panel and in mails follow the server's time zone (TZ, else
  /etc/localtime), as in Vaultwarden. Before, they were always UTC.
• php artisan vaultwarden:check examines a copy of a Vaultwarden installation before the move: settings,
  data folder, RSA key, schema, and rows that cannot be read. It prints only counts and names
  (Moving from Vaultwarden).
  The release archives now include parity/schema, which the check compares against.
• .env.example starts with production settings and lists Vaultwarden's most important settings.
  The README and the installation, configuration and migration guides are up to date.
• Tests:
  • the official web vault and CLI are tested end to end against both servers
  • moving an installation from Vaultwarden and back is tested on SQLite, MySQL and PostgreSQL

Downloads

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check vaultwarphpen-0.1.1.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

Full Changelog: v0.1.0...v0.1.1