mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
4546653b5a
Several views returned json.dumps() output through HttpResponse, i.e. as text/html, and guess_mac_address reflects the URL's vname into it (reflected XSS). Templates filled the log table and volume dropdowns by concatenating server data into HTML strings, and log messages contain user-entered snapshot/disk/clone names (stored XSS that runs when a superuser opens the Logs tab). - Use JsonResponse in guess_mac_address, random_mac_address, guess_clone_name, sshkeys, storages.get_volumes, datasource.os_metadata_json and logs.vm_logs; sshkeys?plain=true is served as text/plain. - stats_tab.html builds log rows with .text(); instance.html and create_instance_w2.html build <option> elements with .val().text().
44 lines
1 KiB
Python
44 lines
1 KiB
Python
import logging
|
|
|
|
from django.http import JsonResponse
|
|
|
|
from admin.decorators import superuser_only
|
|
from instances.models import Instance
|
|
from logs.models import Logs
|
|
|
|
|
|
def addlogmsg(user, host, instance, message):
|
|
"""
|
|
:param user:
|
|
:param host:
|
|
:param instance:
|
|
:param message:
|
|
:return:
|
|
"""
|
|
add_log_msg = Logs(user=user, host=host, instance=instance, message=str(message))
|
|
add_log_msg.save()
|
|
logger = logging.getLogger("")
|
|
logger.info(f"{user} {host} {instance} {message}")
|
|
|
|
|
|
@superuser_only
|
|
def vm_logs(request, vname):
|
|
"""
|
|
:param request:
|
|
:param vname:
|
|
:return:
|
|
"""
|
|
|
|
vm = Instance.objects.get(name=vname)
|
|
logs_ = Logs.objects.filter(instance=vm.name, date__gte=vm.created).order_by("-date")
|
|
logs = []
|
|
for l in logs_:
|
|
log = dict()
|
|
log["user"] = l.user
|
|
log["host"] = l.host
|
|
log["instance"] = l.instance
|
|
log["message"] = l.message
|
|
log["date"] = l.date.strftime("%x %X")
|
|
logs.append(log)
|
|
|
|
return JsonResponse(logs, safe=False)
|