mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
1227674d8f
- Computes API: mark password as write_only in ComputeSerializer, restrict ComputeViewSet and architectures to IsAdminUser. - Instances API: enforce user ownership tenant isolation in InstanceViewSet.list, restrict MigrateViewSet and CreateInstanceViewSet to IsAdminUser, require IsAdminUser for mutating FlavorViewSet. - Storage, Network, and Interface APIs: restrict StorageViewSet, VolumeViewSet, NetworkViewSet, InterfaceViewSet to IsAdminUser. - AppSettings & NWFilters: protect appsettings and nwfilter views with @superuser_only (403 Forbidden for non-superusers). - noVNC Console: sign tokens with TimestampSigner (salt='console.novnc', max_age=600), verify signature and user authorization in novncd with backward-compatible fallback for debug/test mode. - Accounts: avoid hardcoded default admin password; generate cryptographically secure random password unless ADMIN_PASSWORD is set (preserve 'admin' in test runner). - gstfsd daemon: bind to 127.0.0.1 by default instead of 0.0.0.0. - Tests: added comprehensive test coverage for API security, token expiration/rejection, and view permissions (132 tests passing).
30 lines
845 B
Python
30 lines
845 B
Python
from computes.models import Compute
|
|
from django.shortcuts import get_object_or_404
|
|
from rest_framework import permissions, viewsets
|
|
from rest_framework.response import Response
|
|
from vrtManager.network import wvmNetworks
|
|
|
|
from .serializers import NetworksSerializer
|
|
|
|
|
|
class NetworkViewSet(viewsets.ViewSet):
|
|
"""
|
|
A viewset for listing retrieving networks.
|
|
"""
|
|
|
|
permission_classes = [permissions.IsAdminUser]
|
|
|
|
def list(self, request, compute_pk=None):
|
|
|
|
compute = get_object_or_404(Compute, pk=compute_pk)
|
|
|
|
conn = wvmNetworks(
|
|
compute.hostname, compute.login, compute.password, compute.type
|
|
)
|
|
queryset = conn.get_networks_info()
|
|
|
|
serializer = NetworksSerializer(
|
|
queryset, many=True, context={"request": request}
|
|
)
|
|
|
|
return Response(serializer.data)
|