mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
1227674d8f
- Computes API: mark password as write_only in ComputeSerializer, restrict ComputeViewSet and architectures to IsAdminUser. - Instances API: enforce user ownership tenant isolation in InstanceViewSet.list, restrict MigrateViewSet and CreateInstanceViewSet to IsAdminUser, require IsAdminUser for mutating FlavorViewSet. - Storage, Network, and Interface APIs: restrict StorageViewSet, VolumeViewSet, NetworkViewSet, InterfaceViewSet to IsAdminUser. - AppSettings & NWFilters: protect appsettings and nwfilter views with @superuser_only (403 Forbidden for non-superusers). - noVNC Console: sign tokens with TimestampSigner (salt='console.novnc', max_age=600), verify signature and user authorization in novncd with backward-compatible fallback for debug/test mode. - Accounts: avoid hardcoded default admin password; generate cryptographically secure random password unless ADMIN_PASSWORD is set (preserve 'admin' in test runner). - gstfsd daemon: bind to 127.0.0.1 by default instead of 0.0.0.0. - Tests: added comprehensive test coverage for API security, token expiration/rejection, and view permissions (132 tests passing).
30 lines
1 KiB
Python
30 lines
1 KiB
Python
from django.contrib.auth.models import User
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
from computes.models import Compute
|
|
|
|
|
|
class NWFiltersTestCase(TestCase):
|
|
def setUp(self):
|
|
self.compute = Compute.objects.create(
|
|
name="nwfilter-test-compute",
|
|
hostname="127.0.0.1",
|
|
login="root",
|
|
password="",
|
|
type=1,
|
|
)
|
|
self.regular_user = User.objects.create_user(
|
|
username="regular_nwfilter", password="pwd"
|
|
)
|
|
|
|
def test_nwfilters_non_superuser_forbidden(self):
|
|
self.client.force_login(self.regular_user)
|
|
response = self.client.get(reverse("nwfilters", args=[self.compute.id]))
|
|
self.assertEqual(response.status_code, 403)
|
|
|
|
def test_nwfilter_detail_non_superuser_forbidden(self):
|
|
self.client.force_login(self.regular_user)
|
|
response = self.client.get(
|
|
reverse("nwfilter", args=[self.compute.id, "clean-traffic"])
|
|
)
|
|
self.assertEqual(response.status_code, 403)
|