mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
create_storage_ceph and create_storage_netfs wrote the pool, host, user, secret and format values into the pool XML unescaped and unchecked: the page's patterns were the only guard, and a direct POST could break or extend the XML. The values now go through util.xml_escape, as the network code does. The page's host fields stopped at 20 characters, so nfs01.storage.example.com could not be typed: they take a host name's 253; the Ceph pool and user fields lose the limit the server never had. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_live_pools.py | ||
| test_pool_target.py | ||
| test_pool_xml.py | ||
| test_sftp_pipelined.py | ||
| test_ssh_pool.py | ||
| test_upload_job.py | ||
| test_views.py | ||
| test_volume_clone_job.py | ||