catborise 1f9347e148 fix(instances): a new VM and each clone get a VNC password of their own ... Since the VM create became a job (6f0c7300) every new VM was defined with no VNC password, and a clone copied its source's password (or its lack of one) exactly: every clone of a template shared it. Computes listen for VNC on all their addresses (dev/libvirt-bootstrap.sh), so anyone who could reach a compute's VNC ports opened any of these consoles directly, without the panel; the README's firewall rule was the only guard. The create job asks for create.py's random 8-character password again, and a clone's VNC graphics get a new random one. The console page sends the password to a user with passwordless_console, which the user create form now ticks by default next to change_password; a user without it is asked for the password, as the permission intends. Existing VMs keep their settings. Live create, clone and VM page tests pass on a TCP compute.		2026-11-06 20:00:43 +03:00
..
migrations	fix(admin): the Technicians group migration can run on a database that has it	2026-11-06 11:01:58 +03:00
templates/admin	fix(admin): setting a user's password deletes the user's API tokens	2026-11-06 20:00:43 +03:00
tests	fix(instances): a new VM and each clone get a VNC password of their own	2026-11-06 20:00:43 +03:00
__init__.py	chore: remove code nothing uses	2026-11-06 10:53:37 +03:00
apps.py	format python code with black	2022-11-02 08:54:35 +03:00
decorators.py	feat(security): apply Codex review hardening to console tokens and superuser authorization	2026-09-27 11:30:03 +03:00
forms.py	fix(instances): a new VM and each clone get a VNC password of their own	2026-11-06 20:00:43 +03:00
models.py	format python code with black	2022-11-02 08:54:35 +03:00
permissions.py	feat(security): apply Codex review hardening to console tokens and superuser authorization	2026-09-27 11:30:03 +03:00
urls.py	feat(admin): the Logs page searches every row, shows failures and downloads them	2026-10-25 23:08:42 +03:00
views.py	fix(admin): setting a user's password deletes the user's API tokens	2026-11-06 20:00:43 +03:00