mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
eb828b364d
create_storage_ceph and create_storage_netfs wrote the pool, host, user, secret and format values into the pool XML unescaped and unchecked: the page's patterns were the only guard, and a direct POST could break or extend the XML. The values now go through util.xml_escape, as the network code does. The page's host fields stopped at 20 characters, so nfs01.storage.example.com could not be typed: they take a host name's 253; the Ceph pool and user fields lose the limit the server never had. |
||
|---|---|---|
| .. | ||
| tests | ||
| __init__.py | ||
| connection.py | ||
| create.py | ||
| hostdetails.py | ||
| instance.py | ||
| interface.py | ||
| libvirt-ssh | ||
| network.py | ||
| nwfilters.py | ||
| rwlock.py | ||
| storage.py | ||
| util.py | ||
| virtsecrets.py | ||