mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
8a3ee13b41
Disk and media mutation views (add_new_vol, add_existing_vol, edit_volume, delete_vol, detach_vol, add_cdrom, detach_cdrom, mount_iso, unmount_iso) were reachable by any owner with is_change, although the UI only shows the Disk tab to superusers. An ordinary user could delete any volume on the compute or attach arbitrary host files to their VM. - Require superuser for all disk/media views, matching the UI. - delete_vol resolves the volume from the VM's own disk XML by dev and ignores the posted storage/name. - Validate bus/cache/io/discard/detect_zeroes against the hypervisor's lists, and format/serial/volume name against strict patterns. - add_existing_vol only accepts volumes that exist in the selected pool. - edit_volume only accepts a dev attached to the VM. - vrtManager: escape all values interpolated into disk XML and pass dev as an XPath variable in detach_disk/edit_disk. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| connection.py | ||
| create.py | ||
| hostdetails.py | ||
| instance.py | ||
| interface.py | ||
| network.py | ||
| nwfilters.py | ||
| rwlock.py | ||
| storage.py | ||
| test_network_ip.py | ||
| test_rwlock.py | ||
| test_util.py | ||
| test_xml_safety.py | ||
| util.py | ||
| virtsecrets.py | ||