From 75c91f8d53ea6d4d244c9e777e75fbbc6a20bf42 Mon Sep 17 00:00:00 2001 From: catborise Date: Fri, 2 Oct 2026 22:04:45 +0300 Subject: [PATCH] docs(readme): correct the is_staff and 404/403 notes in the roles section is_staff does not reveal console settings or VNC passwords (fixed on fix/wave0-staff-console-password), but staff owners with is_change may also change VMs marked as templates. Superuser-only pages answer 403 to everyone else, and the console page answers 403 both for a missing VM and for a VM the user may not open. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cf8f67a4..25a4a3f3 100644 --- a/README.md +++ b/README.md @@ -468,8 +468,8 @@ WebVirtCloud combines three kinds of access rights: Notes: - Only superusers choose disk names and MAC addresses when cloning; for other users the server derives them. -- `is_staff` gives no access to VMs by itself. -- Users without ownership or `view_instances` get **404** for a VM (its existence is not revealed); users who can see a VM but lack the right for an action get **403**. +- `is_staff` gives no access to VMs and does not reveal console settings or VNC passwords by itself. On VMs where a staff user already has `is_change`, staff may also change VMs that are marked as templates; other owners cannot. +- On VM pages, users without ownership or `view_instances` get **404** (the VM's existence is not revealed), and users who can see a VM but lack the right for an action get **403**. Superuser-only pages answer **403** to everyone else; the console page answers **403** both for a missing VM and for a VM the user may not open. ## LDAP Configuration