j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-11 12:46:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(instances): only superusers and staff owners change a template VM

Browse source 
The documented rule held only for snapshots: an owner with is_change could
still resize a template, set its root password and SSH keys, change its
options and console settings. get_instance(perm_type="change") now
refuses a template to owners who are not staff, which covers every change
view and the API; the per-view snapshot checks it replaces are removed,
and the page offers those controls by the same rule. Viewing, the console,
power (a no-op on a template) and cloning are unchanged.
This commit is contained in:
catborise 2026-10-07 20:59:15 +03:00
parent bf1f122984
commit 4dff1008cc
8 changed files with 53 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

5
instances/utils.py
View file

@ -361,12 +361,15 @@ def can_manage_console(user, instance):
"""
Who may see and change a VM's console settings, including its VNC
password: an active superuser, or an active owner with both is_change and
is_vnc. is_staff and the global view_instances permission do not count.
is_vnc; on a template only a staff owner (as get_instance(perm_type="change")).
is_staff and the global view_instances permission alone do not count.
"""
if not user.is_active:
return False
if user.is_superuser:
return True
if instance.is_template and not user.is_staff:
return False
return UserInstance.objects.filter(
instance=instance, user=user, is_change=True, is_vnc=True
).exists()