j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 19:26:48 +00:00
Code Issues Projects Releases Wiki Activity
webvirtcloud/instances
History
catborise c2fea2aa39 feat(accounts): failed logins lock a user for the address they come from 
Nothing limited failed logins: a password could be guessed at the speed
the server answers. django-axes (8.3.1, Django 5.2, Python 3.10-3.13)
now counts them.

- A user is locked for the address the failed logins come from
  (username and IP together), so an attacker cannot lock someone out
  from elsewhere and users behind one NAT address do not share a lock.
  A successful login resets the count. axes sits in front of every
  authentication: the login page with or without OTP, LDAP and the API.
- The number of failed logins (default 5) and the lock time in minutes
  (default 15) are on the Settings page (LOGIN_FAILURE_LIMIT,
  LOGIN_LOCKOUT_MINUTES, added by migration appsettings.0014) and apply
  at once; an invalid value falls back to the default. Unlock with
  "manage.py axes_reset_username <username>".
- Behind the bundled nginx every request comes from 127.0.0.1; the
  client address is read from X-Real-IP, which nginx sets, but only for
  requests from a loopback address or from LOGIN_TRUSTED_PROXIES, so a
  forged header does not escape a lock.

settings.py.template gets the app, middleware, backend and AXES_*
settings; README tells existing installations what to copy. Tests that
call client.login now pass a request, which the axes backend needs.
The new tests fail with axes disabled.
2026-10-06 11:05:03 +03:00
..
api fix(instances): CD-ROM bus, USB controller and MACs of a new VM 2026-10-04 18:33:28 +03:00
fixtures Instances overhaul 2020-07-13 15:33:09 +06:00
migrations fix(computes): VM ownership survives a move or a short absence 2026-10-04 01:08:11 +03:00
templates fix(instances): the create wizard reaches the page of any architecture 2026-10-06 10:12:08 +03:00
templatetags fix(instances): every VM state has a label and the actions it allows 2026-10-05 19:34:30 +03:00
__init__.py Fixe migrations for new deployments 2020-05-28 18:19:25 +06:00
apps.py format python code with black 2022-11-02 08:54:35 +03:00
forms.py fix(instances): only administrators choose where a console listens 2026-10-05 15:07:31 +03:00
livetest.py fix(instances): domain edits start from the persistent definition 2026-10-04 01:08:11 +03:00
models.py fix(instances): lists show a VM that cannot be read as unknown 2026-10-05 11:03:32 +03:00
states.py fix(instances): every VM state has a label and the actions it allows 2026-10-05 19:34:30 +03:00
test_change_network.py fix(instances): change the edited NIC instead of adding a new one 2026-10-04 01:08:11 +03:00
test_change_xml.py fix(instances): the XML editor saves only while the VM is shut off 2026-10-04 19:13:20 +03:00
test_clone_permission.py fix(instances): clone name and MAC read the same dhcpd.conf 2026-10-04 19:39:29 +03:00
test_console_listener.py fix(instances): only administrators choose where a console listens 2026-10-05 15:07:31 +03:00
test_console_rule.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_console_settings_access.py fix(instances): the page of a VM on an unreachable host points to the list 2026-10-05 12:32:42 +03:00
test_create_instance.py fix(instances): CD-ROM bus, USB controller and MACs of a new VM 2026-10-04 18:33:28 +03:00
test_create_rollback.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_create_wizard_url.py fix(instances): the create wizard reaches the page of any architecture 2026-10-06 10:12:08 +03:00
test_destroy.py fix(instances): destroy and volume delete no longer lose disks 2026-10-04 01:08:11 +03:00
test_detail_reads.py perf(instances): the VM page reads each kind of domain XML once 2026-10-05 21:24:07 +03:00
test_detail_unreachable.py fix(instances): the page of a VM on an unreachable host points to the list 2026-10-05 12:32:42 +03:00
test_disk_isolation.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_error_handling.py fix(instances): failures reach the user; no redirect to other sites 2026-10-04 12:23:54 +03:00
test_gstfsd.py fix: stop ignoring SIGCHLD process-wide 2026-10-04 13:40:53 +03:00
test_index.py fix(instances): guard mutations and refresh lists after sync 2026-09-28 14:56:19 +03:00
test_index_host_alerts.py fix(instances): host errors on the instance list are for administrators 2026-10-05 11:49:46 +03:00
test_list_rpc.py perf(instances): instance lists read a VM's info once per row 2026-10-05 10:17:47 +03:00
test_list_unreachable.py fix(instances): lists show a VM that cannot be read as unknown 2026-10-05 11:03:32 +03:00
test_live_clone.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_create.py fix(instances): CD-ROM bus, USB controller and MACs of a new VM 2026-10-04 18:33:28 +03:00
test_live_dataloss.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_guest.py test(instances): the guest sees the hardware WebVirtCloud configures 2026-10-04 16:39:02 +03:00
test_live_iso.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_xml.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_xml_effects.py fix(instances): disk and agent channel changes on paused VMs 2026-10-04 17:10:49 +03:00
test_quota.py fix(instances): the page of a VM on an unreachable host points to the list 2026-10-05 12:32:42 +03:00
test_quota_lock.py fix(instances): disk edits keep their XML; changes lock per VM 2026-10-04 01:08:11 +03:00
test_root_pass.py feat(accounts): failed logins lock a user for the address they come from 2026-10-06 11:05:03 +03:00
test_security_mutations.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_states.py fix(instances): every VM state has a label and the actions it allows 2026-10-05 19:34:30 +03:00
test_template_flag.py fix(instances): turning a template back into a VM is checked against the quota 2026-10-05 22:19:34 +03:00
test_template_quota.py fix(instances): turning a template back into a VM is checked against the quota 2026-10-05 22:19:34 +03:00
test_update_console.py feat(console): VNC is the only console type 2026-10-04 01:08:11 +03:00
test_xss.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
tests.py feat(accounts): failed logins lock a user for the address they come from 2026-10-06 11:05:03 +03:00
urls.py fix: add an authorization matrix test and close the endpoints it finds 2026-10-02 20:33:12 +03:00
utils.py fix(instances): the quota counts every VM and refuses what it cannot verify 2026-10-05 12:26:57 +03:00
views.py fix: connection errors on VM actions name the host only to administrators 2026-10-06 10:08:48 +03:00