mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
8e23699987
The console settings form on the VM detail page renders the VNC password (PasswordInput(render_value=True)) and was shown to every is_staff user. A staff user with the global view_instances permission, or a staff owner without is_vnc, could read the VNC password of every VM they could see. Add instances.utils.can_manage_console (active superuser, or an active owner with is_change and is_vnc), which matches what update_console already enforced. The detail view only builds the form, and so only puts the password into the page, when it returns True; the template and update_console use the same rule. |
||
|---|---|---|
| .. | ||
| api | ||
| fixtures | ||
| migrations | ||
| templates | ||
| templatetags | ||
| __init__.py | ||
| apps.py | ||
| forms.py | ||
| models.py | ||
| test_console_settings_access.py | ||
| test_create_instance.py | ||
| test_index.py | ||
| test_root_pass.py | ||
| test_security_mutations.py | ||
| tests.py | ||
| urls.py | ||
| utils.py | ||
| views.py | ||