bitwarden/server
1
0
Fork 0
mirror of https://github.com/bitwarden/server synced 2026-01-10 12:33:49 +00:00
Code Issues Releases Wiki Activity

Merge branch 'master' into feature/families-for-enterprise

Browse Source
This commit is contained in:
Justin Baur
2021-11-12 22:33:58 -05:00
committed by GitHub
parent dba01a2c4e f1c41257b3
commit 252b558fe1
90 changed files with 3974 additions and 343 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/Billing/Controllers/AppleController.cs
View File

@@ -1,4 +1,5 @@
using Bit.Core;
using Bit.Core.Utilities;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
@@ -34,7 +35,7 @@ namespace Bit.Billing.Controllers
var key = HttpContext.Request.Query.ContainsKey("key") ?
HttpContext.Request.Query["key"].ToString() : null;
if (key != _billingSettings.AppleWebhookKey)
if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.AppleWebhookKey))
{
return new BadRequestResult();
}

2
src/Billing/Controllers/BitPayController.cs
View File

@@ -49,7 +49,7 @@ namespace Bit.Billing.Controllers
[HttpPost("ipn")]
public async Task<IActionResult> PostIpn([FromBody] BitPayEventModel model, [FromQuery] string key)
{
if (key != _billingSettings.BitPayWebhookKey)
if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.BitPayWebhookKey))
{
return new BadRequestResult();
}

3
src/Billing/Controllers/FreshdeskController.cs
View File

@@ -14,6 +14,7 @@ using System.Threading.Tasks;
using System.ComponentModel.DataAnnotations;
using Bit.Core.Settings;
using Bit.Core.Utilities;
namespace Bit.Billing.Controllers
{
@@ -57,7 +58,7 @@ namespace Bit.Billing.Controllers
var key = HttpContext.Request.Query.ContainsKey("key") ?
HttpContext.Request.Query["key"].ToString() : null;
if (key != _billingSettings.FreshdeskWebhookKey)
if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.FreshdeskWebhookKey))
{
return new BadRequestResult();
}

3
src/Billing/Controllers/PayPalController.cs
View File

@@ -3,6 +3,7 @@ using Bit.Core.Enums;
using Bit.Core.Models.Table;
using Bit.Core.Repositories;
using Bit.Core.Services;
using Bit.Core.Utilities;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
@@ -56,7 +57,7 @@ namespace Bit.Billing.Controllers
var key = HttpContext.Request.Query.ContainsKey("key") ?
HttpContext.Request.Query["key"].ToString() : null;
if (key != _billingSettings.PayPal.WebhookKey)
if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.PayPal.WebhookKey))
{
_logger.LogWarning("PayPal webhook key is incorrect or does not exist.");
return new BadRequestResult();

2
src/Billing/Controllers/StripeController.cs
View File

@@ -83,7 +83,7 @@ namespace Bit.Billing.Controllers
[HttpPost("webhook")]
public async Task<IActionResult> PostWebhook([FromQuery] string key)
{
if (key != _billingSettings.StripeWebhookKey)
if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.StripeWebhookKey))
{
return new BadRequestResult();
}

3
src/Billing/Startup.cs
View File

@@ -82,6 +82,9 @@ namespace Bit.Billing
{
app.UseSerilog(env, appLifetime, globalSettings);
// Add general security headers
app.UseMiddleware<SecurityHeadersMiddleware>();
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();