[PR #2918] [MERGED] Set "Bypass admin page security" as read-only #3183

New issue

Closed

opened 2026-03-03 09:41:46 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 09:41:46 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/2918
Author: @BlackDex
Created: 11/14/2022
Status: ✅ Merged
Merged: 11/27/2022
Merged by: @dani-garcia

Base: main ← Head: issue-2761

📝 Commits (1)

b141f78 Set "Bypass admin page security" as read-only

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 src/config.rs (+1 -1)

📄 Description

It was possible to disable the admin security via the admin interface. This is kinda insecure as mentioned in #2761.

This PR set this value as read-only and admin's need to set the correct ENV variable. Currently saved settings which do override this are still valid though. If an admin want's this removed, they either need to reset the config, or change the value in the config.json file.

Fixes #2761

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/2918 **Author:** [@BlackDex](https://github.com/BlackDex) **Created:** 11/14/2022 **Status:** ✅ Merged **Merged:** 11/27/2022 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `main` ← **Head:** `issue-2761` --- ### 📝 Commits (1) - [`b141f78`](https://github.com/dani-garcia/vaultwarden/commit/b141f789f6905006bcf07546223bc632b453e421) Set "Bypass admin page security" as read-only ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/config.rs` (+1 -1) </details> ### 📄 Description It was possible to disable the admin security via the admin interface. This is kinda insecure as mentioned in #2761. This PR set this value as read-only and admin's need to set the correct ENV variable. Currently saved settings which do override this are still valid though. If an admin want's this removed, they either need to reset the config, or change the value in the `config.json` file. Fixes #2761 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>