mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
c8b0cb3a4a
The source check of a new logical or NFS pool accepted only letters, digits and "/", which refused paths such as /dev/mapper/vg0-data, /dev/disk/by-id/wwn-..., /dev/disk/by-path/pci-0000:00:1f.2-ata-1 or /export/vm_images. The target check let any first character but "-" through, so a quote, "<" or "&" reached the pool XML and libvirt failed on it. Target and source now share one expression: letters, digits, "/", "_", ".", ":" and "-" (not first, not right after "/"), still in linear time. The Vagrant computes' NFS export becomes /srv/wvc-nfs, created through the page in the live pool test.
110 lines
4 KiB
Python
110 lines
4 KiB
Python
import re
|
|
|
|
from django import forms
|
|
from django.utils.translation import gettext_lazy as _
|
|
|
|
# pool target and source paths, both put into the pool XML: letters, digits,
|
|
# "/", "_", ".", ":" (/dev/disk/by-path names) and "-" not first and not right
|
|
# after "/". Written without nested repetition, which backtracked
|
|
# exponentially on crafted input.
|
|
POOL_PATH = re.compile(r"(?!-)(?:[/0-9a-zA-Z_.:]|(?<!/)-)+")
|
|
|
|
|
|
class AddStgPool(forms.Form):
|
|
name = forms.CharField(
|
|
error_messages={"required": _("No pool name has been entered")}, max_length=20
|
|
)
|
|
stg_type = forms.CharField(max_length=10)
|
|
target = forms.CharField(
|
|
error_messages={"required": _("No path has been entered")},
|
|
max_length=100,
|
|
required=False,
|
|
)
|
|
source = forms.CharField(max_length=100, required=False)
|
|
ceph_user = forms.CharField(required=False)
|
|
ceph_host = forms.CharField(required=False)
|
|
ceph_pool = forms.CharField(required=False)
|
|
secret = forms.CharField(required=False)
|
|
netfs_host = forms.CharField(required=False)
|
|
source_format = forms.CharField(required=False)
|
|
|
|
def clean_name(self):
|
|
name = self.cleaned_data["name"]
|
|
have_symbol = re.match("^[a-zA-Z0-9._-]+$", name)
|
|
if not have_symbol:
|
|
raise forms.ValidationError(
|
|
_("The pool name must not contain any special characters")
|
|
)
|
|
elif len(name) > 20:
|
|
raise forms.ValidationError(
|
|
_("The pool name must not exceed 20 characters")
|
|
)
|
|
return name
|
|
|
|
def clean_target(self):
|
|
storage_type = self.cleaned_data["stg_type"]
|
|
target = self.cleaned_data["target"]
|
|
have_symbol = POOL_PATH.fullmatch(target)
|
|
if storage_type in ["dir", "netfs"] and not have_symbol:
|
|
raise forms.ValidationError(
|
|
_("The target must not contain any special characters")
|
|
)
|
|
if storage_type in ["dir", "netfs"] and not target:
|
|
raise forms.ValidationError(_("No path has been entered"))
|
|
return target
|
|
|
|
def clean_source(self):
|
|
storage_type = self.cleaned_data["stg_type"]
|
|
source = self.cleaned_data["source"]
|
|
have_symbol = POOL_PATH.fullmatch(source)
|
|
if storage_type in ["logical", "netfs"]:
|
|
if not source:
|
|
raise forms.ValidationError(_("No device or path has been entered"))
|
|
if not have_symbol:
|
|
raise forms.ValidationError(
|
|
_("The disk source must not contain any special characters")
|
|
)
|
|
return source
|
|
|
|
|
|
class CreateVolumeForm(forms.Form):
|
|
name = forms.CharField(max_length=120)
|
|
format = forms.ChoiceField(
|
|
required=True,
|
|
choices=(("qcow2", "qcow2 (recommended)"), ("qcow", "qcow"), ("raw", "raw")),
|
|
)
|
|
size = forms.IntegerField()
|
|
meta_prealloc = forms.BooleanField(required=False)
|
|
|
|
def clean_name(self):
|
|
name = self.cleaned_data["name"]
|
|
have_symbol = re.match("^[a-zA-Z0-9._-]+$", name)
|
|
if not have_symbol:
|
|
raise forms.ValidationError(
|
|
_("The image name must not contain any special characters")
|
|
)
|
|
return name
|
|
|
|
|
|
class CloneImage(forms.Form):
|
|
name = forms.CharField(max_length=120)
|
|
image = forms.CharField(max_length=120)
|
|
convert = forms.BooleanField(required=False)
|
|
format = forms.ChoiceField(
|
|
required=False,
|
|
choices=(("qcow2", "qcow2 (recommended)"), ("qcow", "qcow"), ("raw", "raw")),
|
|
)
|
|
meta_prealloc = forms.BooleanField(required=False)
|
|
|
|
def clean_name(self):
|
|
name = self.cleaned_data["name"]
|
|
have_symbol = re.match("^[a-zA-Z0-9._-]+$", name)
|
|
if not have_symbol:
|
|
raise forms.ValidationError(
|
|
_("The image name must not contain any special characters")
|
|
)
|
|
elif len(name) > 120:
|
|
raise forms.ValidationError(
|
|
_("The image name must not exceed 120 characters")
|
|
)
|
|
return name
|