catborise 4d34d9d07c fix: add an authorization matrix test and close the endpoints it finds ... Add webvirtcloud/test_authorization_matrix.py, which walks every named URL and checks that a user without any VM/compute relation only reaches an explicit allowlist, and that the global view_instances permission does not open consoles. It found: - /computes/<id>/... views without any check (compute_graph, get_compute_*, get_dom_capabilities, storages.get_volumes): the whole computes URL namespace is now wrapped with superuser_only, so a view added there later cannot be exposed by a missing decorator. - guess_mac_address (leaks dhcpd.conf host/MAC pairs), random_mac_address and guess_clone_name: superuser-only, like the buttons that use them. - check_instance: cross-tenant VM name lookup with no caller; removed. - getvvfile and get_vdi_url: reachable with only view_instances, and the .vv file contains the VNC password. Console access now follows one rule, instances.utils.can_open_console: an active superuser or an active owner of the VM. The global view_instances permission is read-only. It is used by the console page, novncd, getvvfile and get_vdi_url (getvvfile and the VDI tab are kept for virt-viewer users). The console page answers 403 instead of 500 when access is denied, with the same answer for a missing VM.		2026-10-02 20:33:12 +03:00
..
migrations	add new application datasource. provides basic interface for cloud-init tool (hostname, root ssh authorized keys)	2018-06-13 10:50:36 +02:00
templates	fix datasource/templates/user_data, add newline at the end of ssh key and dont add other empty lines by @honza801	2019-11-20 16:53:17 +03:00
__init__.py	add new application datasource. provides basic interface for cloud-init tool (hostname, root ssh authorized keys)	2018-06-13 10:50:36 +02:00
models.py	fix some linter warnings	2020-09-25 15:57:17 +03:00
test_datasource.py	test: expand unit test coverage across admin, accounts, vrtManager, logs, appsettings, and datasource	2026-09-25 11:26:53 +03:00
tests.py	add new application datasource. provides basic interface for cloud-init tool (hostname, root ssh authorized keys)	2018-06-13 10:50:36 +02:00
urls.py	format python code with black	2022-11-02 08:54:35 +03:00
views.py	fix: add an authorization matrix test and close the endpoints it finds	2026-10-02 20:33:12 +03:00