mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
8a3ee13b41
Disk and media mutation views (add_new_vol, add_existing_vol, edit_volume, delete_vol, detach_vol, add_cdrom, detach_cdrom, mount_iso, unmount_iso) were reachable by any owner with is_change, although the UI only shows the Disk tab to superusers. An ordinary user could delete any volume on the compute or attach arbitrary host files to their VM. - Require superuser for all disk/media views, matching the UI. - delete_vol resolves the volume from the VM's own disk XML by dev and ignores the posted storage/name. - Validate bus/cache/io/discard/detect_zeroes against the hypervisor's lists, and format/serial/volume name against strict patterns. - add_existing_vol only accepts volumes that exist in the selected pool. - edit_volume only accepts a dev attached to the VM. - vrtManager: escape all values interpolated into disk XML and pass dev as an XPath variable in detach_disk/edit_disk. |
||
|---|---|---|
| .. | ||
| api | ||
| fixtures | ||
| migrations | ||
| templates | ||
| templatetags | ||
| __init__.py | ||
| apps.py | ||
| forms.py | ||
| models.py | ||
| test_create_instance.py | ||
| test_disk_isolation.py | ||
| test_index.py | ||
| test_root_pass.py | ||
| test_security_mutations.py | ||
| tests.py | ||
| urls.py | ||
| utils.py | ||
| views.py | ||