Skip to content

Commit

Permalink
Validate all needed fields for client API login
Browse files Browse the repository at this point in the history
During the client API login we need to have a `device_identifier`, `device_name` and `device_type`.
When these were not provided Vaultwarden would panic.

This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.
  • Loading branch information
BlackDex committed Feb 19, 2023
1 parent 1ba8275 commit 1ca0d6e
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions src/api/identity.rs
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,10 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, mut conn:
_check_is_some(&data.client_secret, "client_secret cannot be blank")?;
_check_is_some(&data.scope, "scope cannot be blank")?;

_check_is_some(&data.device_identifier, "device_identifier cannot be blank")?;
_check_is_some(&data.device_name, "device_name cannot be blank")?;
_check_is_some(&data.device_type, "device_type cannot be blank")?;

_api_key_login(data, &mut user_uuid, &mut conn, &ip).await
}
t => err!("Invalid type", t),
Expand Down

0 comments on commit 1ca0d6e

Please sign in to comment.