mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
1227674d8f
- Computes API: mark password as write_only in ComputeSerializer, restrict ComputeViewSet and architectures to IsAdminUser. - Instances API: enforce user ownership tenant isolation in InstanceViewSet.list, restrict MigrateViewSet and CreateInstanceViewSet to IsAdminUser, require IsAdminUser for mutating FlavorViewSet. - Storage, Network, and Interface APIs: restrict StorageViewSet, VolumeViewSet, NetworkViewSet, InterfaceViewSet to IsAdminUser. - AppSettings & NWFilters: protect appsettings and nwfilter views with @superuser_only (403 Forbidden for non-superusers). - noVNC Console: sign tokens with TimestampSigner (salt='console.novnc', max_age=600), verify signature and user authorization in novncd with backward-compatible fallback for debug/test mode. - Accounts: avoid hardcoded default admin password; generate cryptographically secure random password unless ADMIN_PASSWORD is set (preserve 'admin' in test runner). - gstfsd daemon: bind to 127.0.0.1 by default instead of 0.0.0.0. - Tests: added comprehensive test coverage for API security, token expiration/rejection, and view permissions (132 tests passing).
79 lines
2.8 KiB
Python
79 lines
2.8 KiB
Python
from django.apps import AppConfig
|
|
from django.db.models.signals import post_migrate
|
|
|
|
|
|
def apply_change_password(sender, **kwargs):
|
|
"""
|
|
Apply new change_password permission for all users
|
|
Depending on settings SHOW_PROFILE_EDIT_PASSWORD
|
|
"""
|
|
from django.conf import settings
|
|
from django.contrib.auth.models import Permission, User
|
|
|
|
if hasattr(settings, "SHOW_PROFILE_EDIT_PASSWORD"):
|
|
print("\033[1m! \033[92mSHOW_PROFILE_EDIT_PASSWORD is found inside settings.py\033[0m")
|
|
print("\033[1m* \033[92mApplying permission can_change_password for all users\033[0m")
|
|
users = User.objects.all()
|
|
permission = Permission.objects.get(codename="change_password")
|
|
if settings.SHOW_PROFILE_EDIT_PASSWORD:
|
|
print("\033[1m! \033[91mWarning!!! Setting to True for all users\033[0m")
|
|
for user in users:
|
|
user.user_permissions.add(permission)
|
|
else:
|
|
print("\033[1m* \033[91mWarning!!! Setting to False for all users\033[0m")
|
|
for user in users:
|
|
user.user_permissions.remove(permission)
|
|
print("\033[1m! Don`t forget to remove the option from settings.py\033[0m")
|
|
|
|
|
|
def create_admin(sender, **kwargs):
|
|
"""
|
|
Create initial admin user
|
|
"""
|
|
import os
|
|
import secrets
|
|
import sys
|
|
from django.contrib.auth.models import User
|
|
|
|
from accounts.models import UserAttributes
|
|
|
|
plan = kwargs.get("plan", [])
|
|
for migration, rolled_back in plan:
|
|
if (
|
|
migration.app_label == "accounts"
|
|
and migration.name == "0001_initial"
|
|
and not rolled_back
|
|
):
|
|
if User.objects.count() == 0:
|
|
is_testing = "test" in sys.argv
|
|
admin_user = os.environ.get("ADMIN_USERNAME", "admin")
|
|
admin_pass = os.environ.get("ADMIN_PASSWORD")
|
|
|
|
if not admin_pass:
|
|
if is_testing:
|
|
admin_pass = "admin"
|
|
else:
|
|
admin_pass = secrets.token_urlsafe(16)
|
|
print(
|
|
f"\033[1m* \033[93mGenerated random admin password: {admin_pass}\033[0m"
|
|
)
|
|
|
|
print(f"\033[1m* \033[92mCreating default admin user '{admin_user}'\033[0m")
|
|
admin = User.objects.create_superuser(admin_user, None, admin_pass)
|
|
UserAttributes(
|
|
user=admin,
|
|
max_instances=-1,
|
|
max_cpus=-1,
|
|
max_memory=-1,
|
|
max_disk_size=-1,
|
|
).save()
|
|
break
|
|
|
|
|
|
class AccountsConfig(AppConfig):
|
|
name = "accounts"
|
|
verbose_name = "Accounts"
|
|
|
|
def ready(self):
|
|
post_migrate.connect(create_admin, sender=self)
|
|
post_migrate.connect(apply_change_password, sender=self)
|