catborise 4546653b5a fix: serve JSON endpoints as application/json and build DOM safely ... Several views returned json.dumps() output through HttpResponse, i.e. as text/html, and guess_mac_address reflects the URL's vname into it (reflected XSS). Templates filled the log table and volume dropdowns by concatenating server data into HTML strings, and log messages contain user-entered snapshot/disk/clone names (stored XSS that runs when a superuser opens the Logs tab). - Use JsonResponse in guess_mac_address, random_mac_address, guess_clone_name, sshkeys, storages.get_volumes, datasource.os_metadata_json and logs.vm_logs; sshkeys?plain=true is served as text/plain. - stats_tab.html builds log rows with .text(); instance.html and create_instance_w2.html build <option> elements with .val().text().		2026-10-02 18:29:11 +03:00
..
migrations	add new application datasource. provides basic interface for cloud-init tool (hostname, root ssh authorized keys)	2018-06-13 10:50:36 +02:00
templates	fix datasource/templates/user_data, add newline at the end of ssh key and dont add other empty lines by @honza801	2019-11-20 16:53:17 +03:00
__init__.py	add new application datasource. provides basic interface for cloud-init tool (hostname, root ssh authorized keys)	2018-06-13 10:50:36 +02:00
models.py	fix some linter warnings	2020-09-25 15:57:17 +03:00
test_datasource.py	test: expand unit test coverage across admin, accounts, vrtManager, logs, appsettings, and datasource	2026-09-25 11:26:53 +03:00
tests.py	add new application datasource. provides basic interface for cloud-init tool (hostname, root ssh authorized keys)	2018-06-13 10:50:36 +02:00
urls.py	format python code with black	2022-11-02 08:54:35 +03:00
views.py	fix: serve JSON endpoints as application/json and build DOM safely	2026-10-02 18:29:11 +03:00