github-actions[bot]
7a5c365dae
chore: sync Bitwarden global domain rules ( #394 )
2026-10-05 22:08:06 +08:00
shuaiplus
293f5ce196
fix: preserve vault fields and align cipher compatibility
...
Preserve linked and unknown encrypted fields in Web edits, reject stale and concurrent saves, and support official bulk delete and restore methods while retaining legacy routes.
Add 20 offline compatibility regressions and update undici to 8.10.2. Verified 51 tests, TypeScript checks, locale validation, Web build and Worker deployment dry run. The unpatched braces advisory remains visible.
2026-10-05 14:25:06 +08:00
shuaiplus
5f71cb388c
fix: improve authentication reliability and account compatibility
...
Resolve bugs in internal authentication handling and improve consistency across supported account flows.
Maintain compatibility with existing accounts while preserving user data and established client behavior.
Validation: TypeScript checks, production build, and Worker packaging checks passed.
2026-10-04 15:57:29 +08:00
KiritoXDone
a72592e76e
fix(cipher): clear omitted notes on full update ( #363 )
...
Treat omitted nullable cipher fields as cleared during full updates so stale encrypted notes are not restored by merge fallback.
Fixes #362
2026-08-30 01:57:41 +08:00
Chius
e63f9663e8
security: prevent websocket JWT leakage through URL query tokens ( #349 )
...
* security: prevent websocket JWT query authentication
* fix: harden websocket connection tickets
* fix: expire unused websocket tickets
2026-08-30 01:56:31 +08:00
shuaiplus
652952379b
fix: stop accepting backup blob credentials from the URL
2026-07-26 16:00:39 +08:00
shuaiplus
a0128908e1
fix: align API responses with Bitwarden 2026.7 clients
2026-07-25 21:25:51 +08:00
shuaiplus
6ffdf05dc6
fix: enable official desktop browser integration settings
...
Return Bitwarden's desktop-ui-settings-dialog feature state so supported desktop clients use the official settings dialog with browser integration controls.
Fixes #315
2026-07-23 01:09:44 +08:00
zu1k
f761fffd58
fix: align WebAuthn connectors with Bitwarden clients
...
Add official-compatible mobile and desktop connector flows, preserve exact .html asset paths, and cover the protocol and framing behavior with regression tests.
Fixes #326
2026-07-23 00:39:34 +08:00
shuaiplus
6cbc06f833
feat: add Web Vault visibility switch
2026-07-17 11:32:43 +08:00
shuaiplus
299eda597f
fix(auth): align API keys and exclude device trust backups
2026-07-13 17:41:00 +08:00
shuaiplus
19de8d6e57
fix(auth): require complete password change key data
2026-07-13 17:02:59 +08:00
shuaiplus
63b642b251
fix(storage): safely batch folder deletion binds
2026-07-13 13:30:52 +08:00
shuaiplus
573451c52f
feat(yubico): refactor Yubico credential management and enhance settings UI
2026-07-13 13:05:04 +08:00
shuaiplus
b731a014f1
fix(auth): prevent unexpected session logout
2026-07-13 02:11:12 +08:00
shuaiplus
fa611dc843
fix: require master password for admin and wipe-device actions
...
Gate invite management, user ban/delete, and delete-all-devices behind
masterPasswordHash verification, matching backup step-up auth. The web UI
prompts for the master password in the shared confirm dialog.
2026-07-12 20:43:27 +08:00
shuaiplus
3c581d1fb1
fix: block IPv6 loopback in backup destination URL checks
...
Expand compressed IPv6 hostnames before the private-address allowlist so
forms like ::1 cannot bypass SSRF protection for WebDAV/S3 backup endpoints.
Also reject IPv4-mapped addresses written as ::ffff:hex:hex.
2026-07-12 20:21:45 +08:00
shuaiplus
db31792cef
feat: add fill-assist, assetlinks check, and web-bootstrap to worker-handled paths
2026-07-10 14:23:45 +08:00
shuaiplus
8c65cb2e80
feat: update FIDO2 origins and enable direct unlock for account passkeys
2026-07-10 14:22:24 +08:00
shuaiplus
14dff8ee6a
feat: disable new-device verification and update related logic across services
2026-07-10 13:00:32 +08:00
shuaiplus
04cb475935
feat: enhance date formatting in PublicSendPage and SendsPage components
2026-07-08 19:31:11 +08:00
shuaiplus
a366acbac0
Revert redirect guard in backup uploader
2026-07-06 23:54:17 +08:00
shuaiplus
57c5ef9da6
Remove WEBSITE_ICONS_ENABLED and always enable website icons
2026-07-06 22:56:36 +08:00
shuaiplus
f532d3ace3
Preserve WebAuthn credential purpose in backups
2026-07-06 22:25:02 +08:00
shuaiplus
cc4a830be8
Harden backup and download token flows
2026-07-06 19:06:24 +08:00
shuaiplus
c6438747e3
Harden 2FA disable and website icon privacy
2026-07-06 18:45:54 +08:00
shuaiplus
5c8f01be59
Harden backup blob and remote endpoint handling
2026-07-06 18:17:55 +08:00
shuaiplus
7ac6ae50bb
Harden auth requests and backup endpoints
2026-07-06 18:04:23 +08:00
shuaiplus
ace00e8e74
Harden WebAuthn extension origins
2026-07-06 17:43:57 +08:00
shuaiplus
51428461a8
fix: cap multipart backup and upload requests
2026-07-06 15:38:59 +08:00
shuaiplus
23c53bd1af
fix: validate anonymous notification hub requests
2026-07-06 15:38:52 +08:00
shuaiplus
ae168bea31
fix rate limit reset bypasses
2026-07-06 14:24:01 +08:00
shuaiplus
00e0ec0892
fix(backup): redact destination secrets in settings
2026-07-06 13:50:49 +08:00
shuaiplus
2df43ccdb0
fix(auth): revoke current access token session
2026-07-06 13:49:06 +08:00
shuaiplus
fd46dffc34
fix: align push relay installation requests
2026-07-06 02:09:35 +08:00
shuaiplus
56b301f2d1
fix: align fill assist compatibility
2026-07-06 02:09:28 +08:00
shuaiplus
f0e523376c
fix: add admin auth request compatibility
2026-07-06 01:35:26 +08:00
shuaiplus
8b2f98b847
fix: add Bitwarden device registration endpoints
2026-07-06 01:35:19 +08:00
shuaiplus
cde4555add
fix: return unsupported for email and kdf flows
2026-07-06 01:35:12 +08:00
shuaiplus
e376a840c2
fix: add device verification settings endpoints
2026-07-06 00:59:34 +08:00
shuaiplus
109593da90
feat: support Bitwarden extended cipher types
2026-07-06 00:44:17 +08:00
shuaiplus
d028b194e7
fix(admin): record audit clears and passkey 2fa status
2026-07-05 23:45:18 +08:00
shuaiplus
cf14704d99
fix(import): validate payloads and zip entries
2026-07-05 23:44:36 +08:00
shuaiplus
0cef6a04e9
fix(backup): verify remote deletes and validate archives
2026-07-05 23:44:25 +08:00
shuaiplus
8c481a1564
fix(send): refresh routes and gate file access
2026-07-05 23:44:07 +08:00
shuaiplus
d9a36fefe6
fix(security): harden auth and request limits
2026-07-05 23:43:49 +08:00
shuaiplus
d8cc88d9c0
feat: add UUID normalization functions and enhance WebAuthn response handling
2026-07-05 15:37:02 +08:00
shuaiplus
94b5f3e975
Merge branch 'main' of https://github.com/shuaiplus/nodewarden
2026-07-05 15:17:00 +08:00
shuaiplus
e73ae3d5ea
feat: enhance two-factor authentication handling and UI improvements
2026-07-05 15:05:53 +08:00
shuaiplus
c019c93726
feat: add passkey-based two-factor authentication
2026-07-05 14:51:11 +08:00
github-actions[bot]
shuaiplus
KiritoXDone
Chius
zu1k
shuaiplus