j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-09 11:46:49 +00:00
Code Issues Projects Releases Wiki Activity
webvirtcloud/accounts
History
catborise cf1cde376b fix: require POST for user block/unblock and OTP email, flag console cookie 
- user_block, user_unblock and admin_email_otp changed state on GET, so an
  <img> tag could lock a user out or trigger OTP emails through an
  admin's session. They now require POST; the buttons are CSRF forms.
- The console token cookie is set with httponly, SameSite=Lax and, on
  HTTPS, secure. Only novncd reads it; the page gets the token directly.
2026-10-02 22:44:00 +03:00
..
migrations feat(security): enforce require_POST on power actions, prevent open redirects, and isolate instance permissions 2026-09-27 13:20:45 +03:00
templates fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
templatetags lint with black python. convert f style strings to old one. some small fixes 2020-11-05 12:34:31 +03:00
__init__.py Fixe migrations for new deployments 2020-05-28 18:19:25 +06:00
apps.py feat(security): implement P0 critical security fixes for API, console, and access control 2026-09-27 10:50:09 +03:00
forms.py format python code with black 2022-11-02 08:54:35 +03:00
models.py feat(security): enforce require_POST on power actions, prevent open redirects, and isolate instance permissions 2026-09-27 13:20:45 +03:00
test_admin_email_otp.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
test_security_fixes.py feat(security): enforce require_POST on power actions, prevent open redirects, and isolate instance permissions 2026-09-27 13:20:45 +03:00
test_utils.py test: expand unit test coverage across admin, accounts, vrtManager, logs, appsettings, and datasource 2026-09-25 11:26:53 +03:00
tests.py fix(tests): decouple tests from local libvirt, support configurable test host, and fix URL/logging bugs 2026-09-25 11:51:45 +03:00
urls.py fix(tests): decouple tests from local libvirt, support configurable test host, and fix URL/logging bugs 2026-09-25 11:51:45 +03:00
utils.py feat(security): enforce require_POST on power actions, prevent open redirects, and isolate instance permissions 2026-09-27 13:20:45 +03:00
views.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00