mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
8e23699987
The console settings form on the VM detail page renders the VNC password (PasswordInput(render_value=True)) and was shown to every is_staff user. A staff user with the global view_instances permission, or a staff owner without is_vnc, could read the VNC password of every VM they could see. Add instances.utils.can_manage_console (active superuser, or an active owner with is_change and is_vnc), which matches what update_console already enforced. The detail view only builds the form, and so only puts the password into the page, when it returns True; the template and update_console use the same rule. |
||
|---|---|---|
| .. | ||
| instances | ||
| add_instance_network_block.html | ||
| add_instance_owner_block.html | ||
| add_instance_volume.html | ||
| allinstances.html | ||
| allinstances_index_grouped.html | ||
| allinstances_index_nongrouped.html | ||
| bottom_bar.html | ||
| create_flav_block.html | ||
| create_inst_block.html | ||
| create_instance_w1.html | ||
| create_instance_w2.html | ||
| instance.html | ||
| instance_actions.html | ||