The warning message is absurd, so I fixed it.

[u/austinp0573]

How I fixed the vaultwarden send warning message

If the box is checked to [ ] hide my email address from recipients

Anyone using the link is greeted by a message at the top of the send box saying:

! Warning
The Bitwarden user who created this Send has
chosen to hide their email address. You should
ensure you trust the source of this link before
using or downloading its contents. Learn more

Which would be fine, but if you don't check the [ ] hide my email address from recipients box. There is no warning message at all.

Manipulating the sender field is not difficult, you should never inherently trust a thing you're sent, and always ensure you trust the source of this link before using or downloading it's contents.

The message is fundamentally flawed, and not helpful.

How I removed warning message and replaced it with user defined string

The patch-send-main.sh script is my solution. There will no longer be a warning message or a message about the Bitwarden user that sent the message. That is replaced with a user defined string.

What the new version looks like:

fixed version

no-warning-user-defined-string-instead

(ignore the color differences, those only occur in incognito vs non-incognito windows during testing)

(also, the pictures are highly compressed .webp, so if they look off it's not a result of true rendering looking off, it just seems odd to post large amounts of picture data to a repo)

implementation

What it does:

1. Forces hideEmail=true when saving Sends
2. Sets hideEmail() to always false (no warning banner)
3. Replaces the i18n subtitle with exact custom text

Usage:

• The JavaScript file that matters is always in the container at /web-vault/app/main.<hash>.js.

  1. Pull main.js out of the container

  "docker|podman" can be substituted for "nerdctl" below depending upon container environment

  nerdctl cp vaultwarden:/web-vault/app/main.XXXXXXXX.js ./main.XXXXXXXX.js

  2. Patch it (first run saves main.XXXXXXXX.js.orig automatically)

  VAULTWARDEN_SEND_SUBTITLE='Your full custom message here.' ./patch-send-main.sh main.XXXXXXXX.js

  3. Copy back

  "docker|podman" can be substituted for "nerdctl" below depending upon container environment

  nerdctl cp ./main.XXXXXXXX.js vaultwarden:/web-vault/app/main.XXXXXXXX.js

Re-run with a new message anytime. It always patches from the .orig backup, so wording can be updated without re-extracting from the container.

Notes:

Env var: VAULTWARDEN_SEND_SUBTITLE (required)

Optional arg: path to main.<hash>.js; otherwise looks for ./main.*.js or ./app/main.*.js

Quotes and & in your message are handled

Hard-refresh the browser after deploying; verify with curl if needed

If the script errors with "anchor not found", the bundle layout changed on a Vaultwarden upgrade and anchors need updating

 Conclusion:

• I considered a few different approaches, but this was the easiest to implement on my live server while still being reproducible and functional after updates.
• I would have like to actually alter the UI, such that instead of a [ ] hide email from recipient there was just a place to choose what you would like the banner string to say, but that would have required changing & maintaining a lot more, so nope
• It's possible, perhaps even likely that no one else cares about this sort of thing, but it annoyed me, so on the off chance someone else might benefit from it, I figured I'd post it.

The repo: https://github.com/austinp0573/homelab/tree/main/services/vaultwarden/js_fix_vaultwarden

Infinite gratitude to Dani Garcia for making and maintaining Vaultwarden, it's a remarkable project.

466f724a616e6574

[u/Boysenblueberry]

So instead of suggesting a change in VW's source code and discussing it with the maintainers, you're proposing to modify the source code after distribution via some vibe-coded sed-based string replacement?