mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 19:56:48 +00:00
726f330dd0
- An API volume takes the name and size the web form takes. Its name went into the volume XML unchecked, so a name could add elements such as a backing store pointing at another VM's disk; the name is also escaped there now. A size of 0 and metadata preallocation on a non-qcow2 volume are refused or dropped, as on the web form. - An API compute update with an empty or null password keeps the stored one, as the web form does; it emptied it and cut the host off. - The architectures endpoint answers 404 for an unknown compute instead of 500; an unrouted copy of it is removed.
42 lines
2.2 KiB
Python
42 lines
2.2 KiB
Python
"""The compute form never shows the stored password: a password left empty
|
|
on an edit keeps it, a new one replaces it."""
|
|
|
|
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
|
|
from computes.models import Compute
|
|
|
|
|
|
class ComputePasswordTests(TestCase):
|
|
def setUp(self):
|
|
self.client.force_login(get_user_model().objects.create_superuser("cp-admin", "cp@example.com", "pw"))
|
|
|
|
def edit(self, compute, password):
|
|
data = {"name": compute.name, "hostname": compute.hostname, "login": "admin", "password": password,
|
|
"type": compute.type, "details": ""}
|
|
self.client.post(reverse("compute_update", args=[compute.id]), data)
|
|
compute.refresh_from_db()
|
|
return compute.password
|
|
|
|
def test_an_empty_password_keeps_the_stored_one(self):
|
|
for conn_type in (1, 3): # TCP, TLS
|
|
with self.subTest(type=conn_type):
|
|
compute = Compute.objects.create(name=f"cp{conn_type}", hostname="10.0.0.7", login="admin",
|
|
password="secret", type=conn_type)
|
|
self.assertEqual(self.edit(compute, ""), "secret")
|
|
self.assertEqual(self.edit(compute, "other"), "other")
|
|
|
|
def test_a_long_password_is_kept_and_the_page_says_edit(self):
|
|
compute = Compute.objects.create(name="cp-long", hostname="192.0.2.7", login="admin", password="", type=1)
|
|
self.assertContains(self.client.get(reverse("compute_update", args=[compute.id])), "Edit Compute")
|
|
self.assertEqual(self.edit(compute, "p" * 40), "p" * 40)
|
|
|
|
def test_the_api_keeps_the_password_when_it_is_left_empty(self):
|
|
compute = Compute.objects.create(name="cp-api", hostname="192.0.2.8", login="admin", password="secret", type=1)
|
|
for password in ("", None):
|
|
with self.subTest(password=password):
|
|
self.client.patch(f"/api/v1/computes/{compute.id}/", {"password": password}, content_type="application/json")
|
|
compute.refresh_from_db()
|
|
self.assertEqual(compute.password, "secret")
|
|
self.assertEqual(self.client.get("/api/v1/computes/999999/archs/").status_code, 404)
|