j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-11 12:46:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(instances): only superusers and staff owners change a template VM

Browse source 
The documented rule held only for snapshots: an owner with is_change could
still resize a template, set its root password and SSH keys, change its
options and console settings. get_instance(perm_type="change") now
refuses a template to owners who are not staff, which covers every change
view and the API; the per-view snapshot checks it replaces are removed,
and the page offers those controls by the same rule. Viewing, the console,
power (a no-op on a template) and cloning are unchanged.
This commit is contained in:
catborise 2026-10-07 20:59:15 +03:00
parent bf1f122984
commit 4dff1008cc
8 changed files with 53 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -521,6 +521,7 @@ A rollback leaves the clone on a detached HEAD at the restored commit; the updat
- Changing one's own password is the "Can change password" permission (per user or group; new users have it); `SHOW_PROFILE_EDIT_PASSWORD` is gone.
- The admin's first-login password change survives losing `data/admin_password` (migration `accounts.0007`); run `migrate` as a user who can read that file.
- "VM Clone Auto Migrate" is removed; a clone stays on its source host.
- A template VM is changed only by superusers and staff owners with change permission; other owners can still view, open the console and clone it.
- The log rotates (10 MB × 5) in `data/webvirtcloud.log`.
- Docker no longer publishes port 6080; the console goes through nginx on the panel's port (`WS_PUBLIC_PORT`, default 80).