j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(storages): Ceph and NFS pool values are escaped, host names may be long

Browse source 
create_storage_ceph and create_storage_netfs wrote the pool, host, user,
secret and format values into the pool XML unescaped and unchecked: the
page's patterns were the only guard, and a direct POST could break or
extend the XML. The values now go through util.xml_escape, as the
network code does. The page's host fields stopped at 20 characters, so
nfs01.storage.example.com could not be typed: they take a host name's
253; the Ceph pool and user fields lose the limit the server never had.
This commit is contained in:
catborise 2026-10-19 20:33:06 +03:00
parent 7f1780ad2d
commit eb828b364d
4 changed files with 39 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
vrtManager/storage.py
View file

@ -66,6 +66,7 @@ class wvmStorages(wvmConnect):
def create_storage_ceph(
self, stg_type, name, ceph_pool, ceph_host, ceph_user, secret
):
ceph_pool, ceph_host, ceph_user, secret = map(util.xml_escape, (ceph_pool, ceph_host, ceph_user, secret))
xml = f"""
<pool type='{stg_type}'>
<name>{name}</name>
@ -86,6 +87,7 @@ class wvmStorages(wvmConnect):
def create_storage_netfs(
self, stg_type, name, netfs_host, source, source_format, target
):
netfs_host, source_format = util.xml_escape(netfs_host), util.xml_escape(source_format)
xml = f"""
<pool type='{stg_type}'>
<name>{name}</name>