catborise 9c3a7cdbec fix(vrtManager): request values are not written into XPath expressions ... Four lookups built XPath expressions from values that come from requests (CodeQL py/xpath-injection, plus get_capabilities, which CodeQL did not flag; the pages are for superusers): - The architecture in the create wizard's URLs went into arch[@name='...'] in get_emulator, get_machine_types and get_capabilities: "nope' or '1'='1" matched every architecture. It is now an XPath variable ($arch), which is never parsed as XPath. - Network filter rules were found with a predicate built from the posted action, direction and priority: a quote raised SyntaxError (an error page). The rule is now found by comparing its attributes. - unset_qos put the posted direction into the path, so "*" removed every bandwidth setting. It accepts inbound and outbound, as set_qos does; the network page shows an error for anything else. No other XPath in vrtManager is built from a value; the remaining expressions are constants. The tests fail on the previous code.		2026-10-06 08:55:41 +03:00
..
api	fix(api): typed URLs and accurate response schemas	2026-10-04 01:08:11 +03:00
migrations	add missing migrations for new models	2022-08-24 09:34:16 +03:00
templates	logger updates (#31)	2023-08-09 09:20:18 +03:00
__init__.py	Initial commit	2015-02-27 10:53:51 +02:00
forms.py	reorg imports and black format	2022-11-02 16:05:41 +03:00
models.py	format python code with black	2022-11-02 08:54:35 +03:00
tests.py	ci: replace super-linter with ruff	2026-10-04 01:08:11 +03:00
views.py	fix(vrtManager): request values are not written into XPath expressions	2026-10-06 08:55:41 +03:00