mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
novncd accepted signed tokens without the user part, which skipped the per-user access check, and accepted unsigned "host-uuid" tokens whenever "test" appeared in sys.argv. The console view always signs host:uuid:user_id, so anything else is now rejected with PermissionError, and the user check always runs. |
||
|---|---|---|
| .. | ||
| migrations | ||
| templates | ||
| __init__.py | ||
| models.py | ||
| novncd | ||
| socketiod | ||
| sshtunnels.py | ||
| test_cli_parsers.py | ||
| tests.py | ||
| views.py | ||