catborise 4546653b5a fix: serve JSON endpoints as application/json and build DOM safely ... Several views returned json.dumps() output through HttpResponse, i.e. as text/html, and guess_mac_address reflects the URL's vname into it (reflected XSS). Templates filled the log table and volume dropdowns by concatenating server data into HTML strings, and log messages contain user-entered snapshot/disk/clone names (stored XSS that runs when a superuser opens the Logs tab). - Use JsonResponse in guess_mac_address, random_mac_address, guess_clone_name, sshkeys, storages.get_volumes, datasource.os_metadata_json and logs.vm_logs; sshkeys?plain=true is served as text/plain. - stats_tab.html builds log rows with .text(); instance.html and create_instance_w2.html build <option> elements with .val().text().		2026-10-02 18:29:11 +03:00
..
api	feat(security): apply Codex review hardening to console tokens and superuser authorization	2026-09-27 11:30:03 +03:00
migrations	add missing migrations for new models	2022-08-24 09:34:16 +03:00
templates	feat(storage): support resilient ISO uploads across connection types	2026-09-28 14:57:31 +03:00
__init__.py	build new tree	2015-02-27 11:28:22 +02:00
forms.py	refactor(console): replace deprecated optparse with argparse and fix regex escape sequences	2026-09-24 22:08:08 +03:00
models.py	reorg imports and black format	2022-11-02 16:05:41 +03:00
tests.py	feat(storage): support resilient ISO uploads across connection types	2026-09-28 14:57:31 +03:00
upload.py	feat(storage): support resilient ISO uploads across connection types	2026-09-28 14:57:31 +03:00
views.py	fix: serve JSON endpoints as application/json and build DOM safely	2026-10-02 18:29:11 +03:00