j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(console): the console daemons hold to what the console page allowed

Browse source 
The token now names the console type it was made for: novncd accepts only
a VNC page's token and socketiod only a serial page's, so a VNC page's
token no longer opens the serial console without the VNC password.

A VNC session re-checks every 10 s, as the serial one did, that its user
may still open the console; a deactivated user or a removed owner loses
it. The check (may_still_open) moves to console.tokens for both daemons.
This commit is contained in:
catborise 2026-11-05 15:49:31 +03:00
parent f670ee7333
commit 458074df82
10 changed files with 110 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

9
console/tests/test_socketiod.py
View file

@ -36,12 +36,12 @@ class Base(TestCase):
def token(self, user=None, vm=None):
vm = vm or self.vm
return tokens.SIGNER.sign(f"{vm.compute_id}:{vm.uuid}:{(user or self.user).id}")
return tokens.sign(vm.compute_id, vm.uuid, (user or self.user).id, "pty")
class TokenTestCase(Base):
def test_a_token_opens_its_vm_for_a_user_who_may_open_it(self):
self.assertEqual(tokens.authorize(self.token()), (self.vm, self.user))
self.assertEqual(tokens.authorize(self.token(), "pty"), (self.vm, self.user))
def test_refused_tokens(self):
stranger = get_user_model().objects.create_user("stranger", password="pw")
@ -53,14 +53,15 @@ class TokenTestCase(Base):
"tampered": self.token()[:-2] + "xx",
"no access": self.token(stranger),
"inactive user": self.token(inactive),
"a VNC page's token": tokens.sign(self.vm.compute_id, self.vm.uuid, self.user.id, "vnc"),
}
for name, token in cases.items():
with self.subTest(name), self.assertRaises(PermissionError):
tokens.authorize(token)
tokens.authorize(token, "pty")
token = self.token()
with patch("django.core.signing.time.time", return_value=time.time() + tokens.MAX_AGE + 1):
with self.assertRaises(PermissionError):
tokens.authorize(token)
tokens.authorize(token, "pty")
class SocketiodTestCase(Base):