mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
4546653b5a
Several views returned json.dumps() output through HttpResponse, i.e. as text/html, and guess_mac_address reflects the URL's vname into it (reflected XSS). Templates filled the log table and volume dropdowns by concatenating server data into HTML strings, and log messages contain user-entered snapshot/disk/clone names (stored XSS that runs when a superuser opens the Logs tab). - Use JsonResponse in guess_mac_address, random_mac_address, guess_clone_name, sshkeys, storages.get_volumes, datasource.os_metadata_json and logs.vm_logs; sshkeys?plain=true is served as text/plain. - stats_tab.html builds log rows with .text(); instance.html and create_instance_w2.html build <option> elements with .val().text().
120 lines
5.2 KiB
HTML
120 lines
5.2 KiB
HTML
{% load i18n %}
|
|
{% load bootstrap_icons %}
|
|
<div class="tab-pane" id="graphics" role="tabpanel" >
|
|
<!-- Nav tabs -->
|
|
<ul class="nav nav-tabs" role="tablist" aria-label="Instance graphs and logs menu">
|
|
<li class="nav-item" role="presentation">
|
|
<button class="nav-link active" data-bs-toggle="tab" data-bs-target="#graphs" type="button" role="tab" aria-controls="graphs" aria-selected="true">
|
|
{% trans "Real Time" %}
|
|
</button>
|
|
</li>
|
|
<li class="nav-item" role="presentation">
|
|
<button class="nav-link" data-bs-toggle="tab" data-bs-target="#logs" type="button" role="tab" aria-controls="logs" aria-selected="false" onclick="update_logs_table(vname);">
|
|
{% trans "Logs" %}
|
|
</button>
|
|
</li>
|
|
</ul>
|
|
<!-- Tab panes -->
|
|
<div class="tab-content">
|
|
<div role="tabpanel" class="tab-pane tab-pane-bordered active" id="graphs">
|
|
<div class="mb-1 card border-success">
|
|
<div class="card-header">
|
|
<h5 class="card-title">{% bs_icon 'arrow-right' %}
|
|
{% trans "CPU Usage" %}
|
|
</h5>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="flot-chart">
|
|
<div class="flot-chart-content" id="flot-moving-line-chart">
|
|
<canvas id="cpuChart" width="735" height="160"></canvas>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="mb-1 card border-danger">
|
|
<div class="card-header">
|
|
<h5 class="card-title">{% bs_icon 'arrow-right' %}
|
|
{% trans "Memory Usage" %}
|
|
</h5>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="flot-chart">
|
|
<div class="flot-chart-content" id="flot-moving-line-chart">
|
|
<canvas id="memChart" width="735" height="160"></canvas>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% for net in instance.networks %}
|
|
<div class="mb-1 card border-info">
|
|
<div class="card-header">
|
|
<h5 class="card-title">{% bs_icon 'arrow-right' %}
|
|
{% trans "Bandwidth Device" %}: eth{{ forloop.counter0 }}
|
|
</h5>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="flot-chart">
|
|
<div class="flot-chart-content" id="flot-moving-line-chart">
|
|
<canvas id="netEth{{ forloop.counter0 }}Chart" width="735" height="160"></canvas>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endfor %}
|
|
{% for disk in instance.disks %}
|
|
<div class="mb-1 card border-warning">
|
|
<div class="card-header">
|
|
<h5 class="card-title">{% bs_icon 'arrow-right' %}
|
|
{% trans "Disk I/O device" %}: {{ disk.dev }}
|
|
</h5>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="flot-chart">
|
|
<div class="flot-chart-content" id="flot-moving-line-chart">
|
|
<canvas id="blk{{ disk.dev }}Chart" width="735" height="160"></canvas>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endfor %}
|
|
<div class="clearfix"></div>
|
|
</div>
|
|
<div role="tabpanel" class="tab-pane tab-pane-bordered" id="logs">
|
|
<div class="table-responsive">
|
|
<table class="table table-striped sortable-theme-bootstrap" id="logs_table" data-sortable>
|
|
<thead>
|
|
<tr>
|
|
<th scope="col">{% trans "Date" %}</th>
|
|
<th scope="col">{% trans "User" %}</th>
|
|
<th scope="col">{% trans "Message" %}</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody class="searchable">
|
|
<tr>
|
|
<td colspan="3"><i>{% trans 'None' %}...</i></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<div class="clearfix"></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<script>
|
|
function update_logs_table(vname) {
|
|
// TODO
|
|
logurl = "{% url 'vm_logs' 1 %}".replace(1, vname);
|
|
$.getJSON(logurl, function(data) {
|
|
// Log messages contain user-entered names (snapshots, disks, clones);
|
|
// insert them as text, never as HTML.
|
|
var tbody = $("#logs_table > tbody").empty();
|
|
$.each(data, function(id, row) {
|
|
$("<tr>")
|
|
.append($("<td>").css("width", "150px").text(row['date']))
|
|
.append($("<td>").text(row['user']))
|
|
.append($("<td>").text(row['message']))
|
|
.appendTo(tbody);
|
|
});
|
|
});
|
|
}
|
|
</script>
|