catborise 4546653b5a fix: serve JSON endpoints as application/json and build DOM safely ... Several views returned json.dumps() output through HttpResponse, i.e. as text/html, and guess_mac_address reflects the URL's vname into it (reflected XSS). Templates filled the log table and volume dropdowns by concatenating server data into HTML strings, and log messages contain user-entered snapshot/disk/clone names (stored XSS that runs when a superuser opens the Logs tab). - Use JsonResponse in guess_mac_address, random_mac_address, guess_clone_name, sshkeys, storages.get_volumes, datasource.os_metadata_json and logs.vm_logs; sshkeys?plain=true is served as text/plain. - stats_tab.html builds log rows with .text(); instance.html and create_instance_w2.html build <option> elements with .val().text().		2026-10-02 18:29:11 +03:00
..
migrations	add host name for logs beside others	2021-05-31 11:39:09 +03:00
__init__.py	Add logs and block for templates	2015-03-03 11:34:09 +02:00
models.py	add host name for logs beside others	2021-05-31 11:39:09 +03:00
test_logs.py	test: expand unit test coverage across admin, accounts, vrtManager, logs, appsettings, and datasource	2026-09-25 11:26:53 +03:00
tests.py	Add logs and block for templates	2015-03-03 11:34:09 +02:00
urls.py	lint with black python. convert f style strings to old one. some small fixes	2020-11-05 12:34:31 +03:00
views.py	fix: serve JSON endpoints as application/json and build DOM safely	2026-10-02 18:29:11 +03:00