The lite and the full console page each carried the same 150 lines that
send key combinations (Ctrl+Alt+Del, Ctrl+Alt+F1..F12, Alt+Tab, ...). They
now import static/js/console_keys.js, which binds the menu to the page's
RFB connection.
The console pages connect to /novncd/ on the address, scheme and port the
page itself was loaded from; nginx proxies it to novncd, which listens on
the loopback only. There is nothing to configure: the console works on
HTTPS (wss), behind another proxy and on any published port.
Before, the page connected to WS_PUBLIC_HOST/PORT/PATH, port 6080 by
default: straight to novncd, past nginx and without TLS, so an HTTPS panel
and a Docker container published on another port had no console until the
public port was set by hand, and novncd listened on every interface.
Gone: WS_PUBLIC_PORT, WS_PUBLIC_HOST, WS_PUBLIC_PATH and WS_CERT, the
installer's two public console questions and its 6080 firewall rule, the
Docker image's WS_PUBLIC_PORT and its init script lines, the manual
install's firewall rule for 6080 and nginx's unused /websockify location.
WS_HOST defaults to 127.0.0.1. A VM with a QEMU websocket port is still
reached on that port of the panel's host name (left for a separate
decision).
- The lite VNC page took the proxy's host, port and path from its link. A
link naming another host made the page send that host a fresh signed
console token, which opened the VM's console for two minutes. The page
now uses only what the server gives it, like the full page.
- On a local-socket host, a VM whose console listens on 127.0.0.1 is
reached directly instead of being refused for want of an SSH tunnel.
- A shut-off VM's console says that the VM is not running instead of
failing with no reason.
Only an administrator chose whether the VNC console fits the remote
screen to the window (Settings, or ?scale= in the URL). A Scale switch
in the console menu now flips between fitted and 1:1 with scrollbars,
starting from that setting. On a phone, where noVNC takes the touch
screen as the mouse and the 1:1 view cannot be scrolled, it is the way
to see the whole screen.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
readQueryVariable('token', ...) preferred the unsigned host-uuid token
from the URL, which novncd rejects; use the signed token the view
renders, like the full page does.
- Validate and coerce console query parameters (view_only, scale, resize_session, clip_viewport) to strict booleans via to_bool in console/views.py
- Sanitize view parameter to strictly 'lite' or 'full'
- Apply escapejs filter to all JS string interpolations in console-vnc-full.html, console-vnc-lite.html, console-spice-lite.html, and console-xterm.html
- Replace unsafe '| safe' filter in console-spice-lite.html with escapejs
- Add unit tests for XSS query param mitigation and escapejs character encoding
- Upgrade vendored noVNC library in static/js/novnc/ from 1.2.0 to 1.7.0
- Remove obsolete IE11 polyfills (promise.js, browser-es-module-loader)
- Preserve custom app/styles/lite.css for embedded lite view
- Update console-vnc-full.html stylesheets, modern icon set, and dialogs
- Modernize console-vnc-full.html startup via UI.start() with Django context mapping
- Dynamically resolve package.json and localization dictionaries via import.meta.url
