From 0f611e63838158302a6d9dbdc30ec28600fedef8 Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Fri, 2 Oct 2026 23:57:25 +0300
Subject: [PATCH] fix(console): lite noVNC page uses the signed token, not the
 URL token

readQueryVariable('token', ...) preferred the unsigned host-uuid token
from the URL, which novncd rejects; use the signed token the view
renders, like the full page does.
---
 console/templates/console-vnc-lite.html |  2 +-
 console/tests.py                        | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/console/templates/console-vnc-lite.html b/console/templates/console-vnc-lite.html
index 0fbeb745..cf2e41e1 100755
--- a/console/templates/console-vnc-lite.html
+++ b/console/templates/console-vnc-lite.html
@@ -294,7 +294,7 @@
     } else {
         url += '/';
     }
-    const token = readQueryVariable('token', '{{ token|escapejs }}');
+    const token = '{{ token|escapejs }}';
     if (token) {
         url += (url.includes('?') ? '&' : '?') + 'token=' + encodeURIComponent(token);
     }
diff --git a/console/tests.py b/console/tests.py
index e91c1c3d..fb783a01 100644
--- a/console/tests.py
+++ b/console/tests.py
@@ -11,6 +11,7 @@ from django.contrib.auth.models import Permission
 from django.core.signing import TimestampSigner
 from django.test import TestCase, override_settings
 from django.urls import reverse
+from django.utils.html import escapejs
 from instances.models import Instance
 from libvirt import libvirtError
 
@@ -175,6 +176,21 @@ class ConsoleViewsTestCase(TestCase):
         self.assertEqual(response.status_code, 403)
         self.assertIn("permission", response.content.decode("utf-8").lower())
 
+    @patch("console.views.wvmInstance")
+    def test_console_lite_uses_the_signed_token_not_the_url_token(self, mock_wvm):
+        mock_conn = MagicMock()
+        mock_conn.get_console_type.return_value = "vnc"
+        mock_conn.get_console_websocket_port.return_value = None
+        mock_wvm.return_value = mock_conn
+
+        self.client.force_login(self.admin_user)
+        response = self.client.get(reverse("console") + f"?token={self.token}")
+
+        signed = response.context["token"]
+        self.assertNotEqual(signed, self.token)
+        self.assertNotContains(response, "readQueryVariable('token'")
+        self.assertContains(response, f"const token = '{escapejs(signed)}'")
+
     @patch("console.views.wvmInstance")
     def test_console_token_cookie_flags(self, mock_wvm):
         # ROADMAP S-11: the token cookie is only read by novncd, never by JS.