j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 11:16:47 +00:00
Code Issues Projects Releases Wiki Activity
webvirtcloud/console
History
catborise cf1cde376b fix: require POST for user block/unblock and OTP email, flag console cookie 
- user_block, user_unblock and admin_email_otp changed state on GET, so an
  <img> tag could lock a user out or trigger OTP emails through an
  admin's session. They now require POST; the buttons are CSRF forms.
- The console token cookie is set with httponly, SameSite=Lax and, on
  HTTPS, secure. Only novncd reads it; the page gets the token directly.
2026-10-02 22:44:00 +03:00
..
migrations Add app 2015-02-27 14:25:41 +02:00
templates feat(console): remove deprecated SPICE support in favor of noVNC 2026-09-26 22:43:40 +03:00
__init__.py Add app 2015-02-27 14:25:41 +02:00
models.py Add app 2015-02-27 14:25:41 +02:00
novncd fix(console): accept only signed host:uuid:user_id tokens in novncd 2026-10-02 20:35:29 +03:00
socketiod fix(console): disable the unauthenticated serial console by default 2026-10-02 17:22:20 +03:00
sshtunnels.py format python code with black 2022-11-02 08:54:35 +03:00
test_cli_parsers.py refactor(console): replace deprecated optparse with argparse and fix regex escape sequences 2026-09-24 22:08:08 +03:00
test_socketiod_disabled.py fix(console): keep socketiod behind nginx and off by default there too 2026-10-02 22:27:39 +03:00
tests.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
views.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00