dani-garcia / vaultwarden

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
GNU Affero General Public License v3.0
39.36k stars 1.91k forks source link

Hide user name on invite status #5110

Closed BlackDex closed 1 month ago

BlackDex commented 1 month ago

A possible user disclosure when you invite an user into an organization which already has an account on the same instance. This was because we always returned the user's name. To prevent this, this PR only returns the user's name if the status is accepted or higher, else we will return null. This is the same as Bitwarden does.

Resolves a reported issue.

Also resolved a new nightly reported clippy regarding a regex within a loop.