Replies: 2 comments 11 replies
|
Just tried to upgrade from 1.35.8. Doesn't start, here is the container log: |
|
Looks more like database right issues too me. |
|
Ok, thanks. Not really a DB expert, could you please tell me how the DB rights should be set? |
|
Not really, it looks like the the table or database isn't fully owned by the user you configured. |
|
Fixed, and now it works. It was due to a refacto of my home lab, with a PG move. Thanks for the help. |
|
Ah, yes, PG can sometimes do weird stuff like that. |
|
Hello, testing an upate from 1.35.7, oauth2 with EntraID. |
|
i'm also getting following this code here: let state = sso::decode_state(&base64_state)?;
let mut sso_auth = match SsoAuth::find(&state, conn).await {
None => err!(format!("Cannot retrieve sso_auth for {state}")),
Some(sso_auth) => sso_auth,
};
// Browser-binding check
// The cookie was set on /connect/authorize and must come from the same browser that initiated the flow.
let cookie_value = cookies.get(SSO_BINDING_COOKIE).map(|c| c.value().to_string());
let provided_hash = cookie_value.as_deref().map(|v| crypto::sha256_hex(v.as_bytes()));
match (sso_auth.binding_hash.as_deref(), provided_hash.as_deref()) {
(Some(expected), Some(actual)) if crypto::ct_eq(expected, actual) => {}
_ => err!(format!("SSO session binding mismatch for {state}")),
}it definitely finds a matching entry in the database. i looked up the entry matching my current ah this change here to add the session binding d297e27#diff-1c5b0c87dec2154a167b89110c637a7a4bc04f59af0b83e8ddba39eb2134518cL1242 doesn't take the subpath into account (neither does the code that removes the cookie) assuming subpath hosting is still supported, should that cookie managing code compute the path relative to the base url? i would gladly submit a pull request but i have no practical rust experience. i mean, this could be the practical rust experience 🤷♀️ anyway ty for vaultwarden ❤️ it is a beloved piece of our homelab Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)Show Config & DetailsEnvironment settings which are overridden: DOMAIN, ADMIN_TOKEN, SSO_ENABLED, SSO_ONLY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_AUTHORITY, SSO_SCOPES, SSO_PKCE, SSO_AUTH_ONLY_NOT_SESSION, SMTP_HOST, SMTP_SECURITY, SMTP_FROM, SMTP_FROM_NAME Config: {
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": true,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "***:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "/var/lib/vaultwarden/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "/var/lib/vaultwarden",
"database_conn_init": "",
"database_idle_timeout": 600,
"database_max_conns": 10,
"database_min_conns": 2,
"database_timeout": 30,
"database_url": "**********://*************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"dns_prefer_ipv6": false,
"domain": "*****://********************",
"domain_origin": "*****://**************",
"domain_path": "******",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "/var/cache/vaultwarden/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Etherbunny",
"invitations_allowed": true,
"ip_header": "X-Real-IP",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "error",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"purge_incomplete_sso_auth": "0 20 0 * * *",
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "/var/lib/vaultwarden/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "/var/lib/vaultwarden/sends",
"show_password_hint": false,
"signups_allowed": true,
"signups_domains_whitelist": "**************",
"signups_verify": true,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": null,
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "**************************",
"smtp_from_name": "***********",
"smtp_host": "*********",
"smtp_password": null,
"smtp_port": 25,
"smtp_security": "off",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": null,
"sso_allow_unknown_email_verification": true,
"sso_audience_trusted": null,
"sso_auth_only_not_session": true,
"sso_authority": "*****://***********************",
"sso_authorize_extra_params": "",
"sso_callback_path": "*****://*************************************************",
"sso_client_cache_expiration": 0,
"sso_client_id": "****************************************************************",
"sso_client_secret": "***",
"sso_debug_tokens": false,
"sso_enabled": true,
"sso_master_password_policy": null,
"sso_only": false,
"sso_pkce": true,
"sso_scopes": "profile email offline_access vaultwarden",
"sso_signups_match_email": true,
"templates_folder": "/var/lib/vaultwarden/templates",
"tmp_folder": "/tmp/vaultwarden",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": true,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "/usr/share/webapps/vaultwarden-web",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
} |
|
Yes, seems @morganther found the cause, I work with subpath too. |
|
Ah, crap, that is something i have missed! Thanks! |
|
I have a fix for that here #7187, once merged you should be able to use |
|
works beautifully! i applied it as a patch to the gentoo package. tysm |
Uh oh!
There was an error while loading. Please reload this page.
Security Fixes
This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
GHSA-pfp2-jhgq-6hg5
GHSA-w6h6-8r66-hcv7
GHSA-hxqh-ff5p-wfr3
GHSA-j4j8-gpvj-7fqr
GHSA-6x5c-84vm-5j56
GHSA-72vh-x5jq-m82g
These are private for now, pending CVE assignment.
Notes
https://bitwarden.com/blog/keep-your-vault-tidy-with-item-archiving/
https://bitwarden.com/nl-nl/help/managing-items/#archive
What's Changed
duration_suboptimal_unitslint findings by @dfunkt in Applyduration_suboptimal_unitslint findings #7144ref_optionlint findings by @dfunkt in Applyref_optionlint findings #7143New Contributors
Full Changelog: 1.35.8...1.36.0
All reactions