j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-09 11:46:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(instances): only superusers and staff owners change a template VM

Browse source 
The documented rule held only for snapshots: an owner with is_change could
still resize a template, set its root password and SSH keys, change its
options and console settings. get_instance(perm_type="change") now
refuses a template to owners who are not staff, which covers every change
view and the API; the per-view snapshot checks it replaces are removed,
and the page offers those controls by the same rule. Viewing, the console,
power (a no-op on a template) and cloning are unchanged.
This commit is contained in:
catborise 2026-10-07 20:59:15 +03:00
parent bf1f122984
commit 4dff1008cc
8 changed files with 53 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

11
webvirtcloud/test_authorization_matrix.py
View file

@ -128,10 +128,13 @@ ROLE_EXPECTATIONS = {
}
# A template VM is reached the same way: on templates, snapshot requests and
# poweron are no-ops for these roles, and cloning (which none of them may do
# without instances.clone_instances) has its own rule, see the clone test.
TEMPLATE_ROLE_EXPECTATIONS = ROLE_EXPECTATIONS
# A template VM: only superusers and staff owners with is_change change it;
# other owners with is_change keep view, power (poweron is a no-op on a
# template) and console. Cloning has its own rule, see the clone test.
TEMPLATE_ROLE_EXPECTATIONS = {
**ROLE_EXPECTATIONS,
"owner_is_change": (False, False, {"is_change": True}, VIEW_VM | POWER_AND_CONSOLE),
}
def iter_patterns(patterns, prefix="", params=None):