mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
4ece22230e
The edit dialog of a secret was filled with its current value, so every readable secret's value was in the secrets page's HTML. A private secret, or one with no value yet, cannot be read: its field held the text "None", which is valid base64, and saving the dialog unchanged set the secret to the three bytes it decodes to. The dialog now only writes a new value: the field starts empty, is a password field and is required. The page no longer reads secret values, and get_secret_value, used only for that, is gone.
26 lines
1 KiB
Python
26 lines
1 KiB
Python
import base64
|
|
|
|
from lxml import etree
|
|
from vrtManager.connection import wvmConnect
|
|
|
|
# the element of <usage> that holds the value, per usage type
|
|
USAGE_ELEMENTS = {"ceph": "name", "volume": "volume", "iscsi": "target"}
|
|
|
|
|
|
class wvmSecrets(wvmConnect):
|
|
def create_secret(self, ephemeral, private, secret_type, data):
|
|
# built with lxml: data is text, whatever characters it holds
|
|
secret = etree.Element("secret", ephemeral=ephemeral, private=private)
|
|
usage = etree.SubElement(secret, "usage", type=secret_type)
|
|
etree.SubElement(usage, USAGE_ELEMENTS[secret_type]).text = data
|
|
self.wvm.secretDefineXML(etree.tostring(secret, encoding="unicode"))
|
|
|
|
def set_secret_value(self, uuid, value):
|
|
"""value: the new value as base64 text."""
|
|
secrt = self.get_secret(uuid)
|
|
# validate: a value that is not base64 is refused, not decoded to other bytes
|
|
secrt.setValue(base64.b64decode(value, validate=True))
|
|
|
|
def delete_secret(self, uuid):
|
|
secrt = self.get_secret(uuid)
|
|
secrt.undefine()
|