- A secret is in use when a VM names it in a disk, a host device or its
vTPM, or a pool in its source, by UUID or by its usage within the usage
type, as they run and as saved. The vTPM, host devices and pools' saved
definitions were not checked before.
- A Ceph key is taken in base64, as `ceph auth get-key` prints it; any other
value is a password or passphrase stored as typed, spaces included.
- A new secret takes its value at once; a value refused leaves no secret.
- TLS and vTPM secrets can be created; the usage has no length limit.
- Every POST redirects; the list is read once and only with its users; a
secret, VM or pool gone meanwhile is left out.
- domain_trees() is shared by the in-use checks of secrets, network filters,
networks and pools; the storage page's Ceph secret picker reads the same
listing.
Stopping a network cut the running VMs on it off, deleting one or a
secret kept the VMs that name it from starting, and stopping a pool
took the disks of running VMs away, all without a word. Each is now
refused with the VMs (and, for a secret, the pools) that need it:
stopping while a running VM uses it, deleting while a VM's definition
names it. A disk given by its file path does not need its pool's
definition. The API's pool stop is refused the same way.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The edit dialog of a secret was filled with its current value, so every
readable secret's value was in the secrets page's HTML. A private
secret, or one with no value yet, cannot be read: its field held the
text "None", which is valid base64, and saving the dialog unchanged set
the secret to the three bytes it decodes to. The dialog now only writes
a new value: the field starts empty, is a password field and is
required. The page no longer reads secret values, and get_secret_value,
used only for that, is gone.
get_secret_value returned bytes, so the edit dialog showed b'cHc=' (the
bytes' repr) for the base64 value cHc=. Saving the dialog as shown fed
"b'cHc='" to b64decode, which dropped the quotes and the b and stored
other bytes: the secret silently changed (pw became m\xc1\xdc). The value
is now base64 text, and set_secret_value decodes with validate=True, so
a value that is not base64 is refused with a message instead. The field
had an invalid pattern ([a-zA-Z0-9]$+, ignored by browsers) and a 45
character limit; it takes base64 of any length.
create_secret wrote the usage value into the secret XML with an f-string,
unchecked: a quote, "<" or "&" broke the XML or added to it. The page's
pattern ([a-z0-9. ]+) was the only check and refused real values: a
volume secret's path ("/") and an iSCSI IQN ("-", ":"). The XML is now
built with lxml, so the value is text whatever it holds, and the input
keeps only required and the form's 100 characters; libvirt reports a
value it does not take.
A live test creates a volume, an iSCSI and a Ceph secret with real
values through the page.
