nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-06 13:38:13 -05:00
Code

added duofederal.com to allowed duo domains (#1091)

Browse Source
This commit is contained in:
Kyle Spearrin 2021-01-15 16:59:51 -05:00 committed by GitHub
parent adbfd0e107
commit 61675342c3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Core/Models/Api/Request/TwoFactorRequestModels.cs
View File

@ -103,7 +103,7 @@ namespace Bit.Core.Models.Api
public IEnumerable<ValidationResult> Validate(ValidationContext validationContext) public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
{ {
if (!Host.StartsWith("api-") || !Host.EndsWith(".duosecurity.com")) if (!Host.StartsWith("api-") || (!Host.EndsWith(".duosecurity.com") && !Host.EndsWith(".duofederal.com")))
{ {
yield return new ValidationResult("Host is invalid.", new string[] { nameof(Host) }); yield return new ValidationResult("Host is invalid.", new string[] { nameof(Host) });
} }

5
util/Setup/Configuration.cs
View File

@ -76,8 +76,9 @@ namespace Bit.Setup
"WARNING: Reconfiguring this parameter may break features. By changing this parameter\n" + "WARNING: Reconfiguring this parameter may break features. By changing this parameter\n" +
"you become responsible for maintaining this value.")] "you become responsible for maintaining this value.")]
public string NginxHeaderContentSecurityPolicy { get; set; } = "default-src 'self'; style-src 'self' " + public string NginxHeaderContentSecurityPolicy { get; set; } = "default-src 'self'; style-src 'self' " +
"'unsafe-inline'; img-src 'self' data: https://haveibeenpwned.com https://www.gravatar.com; " + "'unsafe-inline'; img-src 'self' data: https://haveibeenpwned.com https://www.gravatar.com; " +
"child-src 'self' https://*.duosecurity.com; frame-src 'self' https://*.duosecurity.com; " + "child-src 'self' https://*.duosecurity.com https://*.duofederal.com; " +
"frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; " +
"connect-src 'self' wss://{0} https://api.pwnedpasswords.com " + "connect-src 'self' wss://{0} https://api.pwnedpasswords.com " +
"https://twofactorauth.org; object-src 'self' blob:;"; "https://twofactorauth.org; object-src 'self' blob:;";