j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 19:26:48 +00:00
Code Issues Projects Releases Wiki Activity

fix(instances): snapshot and console settings requests without the permission get 403

Browse source 
Without instances.snapshot_instances (snapshots) or is_vnc (console
settings) the request was accepted and silently did nothing, although
the documented answer for a missing right is 403. delete_external_snapshot
also asked libvirt for the VM state before checking the permission.
This commit is contained in:
catborise 2026-10-07 23:57:10 +03:00
parent 44b3b6569a
commit 9fdb039977
2 changed files with 116 additions and 127 deletions
Download patch file Download diff file Expand all files Collapse all files

14
webvirtcloud/test_authorization_matrix.py
View file

@ -100,16 +100,10 @@ CHANGE_VM = {
"instances:rootpasswd",
"instances:add_public_key",
"instances:change_options",
# Reached, but a no-op without is_vnc (can_manage_console).
"instances:update_console",
# Reached, but a no-op without instances.snapshot_instances.
"instances:snapshot",
"instances:delete_snapshot",
"instances:revert_snapshot",
"instances:create_external_snapshot",
"instances:delete_external_snapshot",
"instances:revert_external_snapshot",
}
# Also needs is_vnc (can_manage_console). Snapshots also need
# instances.snapshot_instances, which no role here has: refused to all.
CONSOLE_SETTINGS = {"instances:update_console"}
DELETE_VM = {"instances:destroy"}
ROLE_EXPECTATIONS = {
@ -123,7 +117,7 @@ ROLE_EXPECTATIONS = {
True,
False,
{"is_change": True, "is_vnc": True},
VIEW_VM | POWER_AND_CONSOLE | CHANGE_VM,
VIEW_VM | POWER_AND_CONSOLE | CHANGE_VM | CONSOLE_SETTINGS,
),
}