1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 19:26:48 +00:00
webvirtcloud/instances
catborise f3929b8e8f fix(instances): only administrators choose where a console listens
A VM owner who may manage the console (is_change and is_vnc) could set
its listen address to all interfaces and remove its password: a VNC
console reachable from the network without a password. Checked on a
test host: the owner's form changed the VM's listen address to 0.0.0.0
and then removed the password.

- The listen address field is disabled for users who are not
  superusers; a disabled field ignores posted values. They can still
  set or change the password and the keymap.
- A console whose persistent definition does not bind it to loopback
  (or a Unix socket) only loses its password through an administrator.
  A binding the XML does not pin down counts as not local: listen type
  network, or no address (the host's default in qemu.conf).

On the test host, the owner's form now leaves the listen address alone
and is refused when it removes the password of a console listening on
0.0.0.0; with the console on localhost the password can be removed.
The new tests fail on the previous code.
2026-10-05 15:07:31 +03:00
..
api fix(instances): CD-ROM bus, USB controller and MACs of a new VM 2026-10-04 18:33:28 +03:00
fixtures Instances overhaul 2020-07-13 15:33:09 +06:00
migrations fix(computes): VM ownership survives a move or a short absence 2026-10-04 01:08:11 +03:00
templates fix(instances): the quota counts every VM and refuses what it cannot verify 2026-10-05 12:26:57 +03:00
templatetags lint with black python. convert f style strings to old one. some small fixes 2020-11-05 12:34:31 +03:00
__init__.py Fixe migrations for new deployments 2020-05-28 18:19:25 +06:00
apps.py format python code with black 2022-11-02 08:54:35 +03:00
forms.py fix(instances): only administrators choose where a console listens 2026-10-05 15:07:31 +03:00
livetest.py fix(instances): domain edits start from the persistent definition 2026-10-04 01:08:11 +03:00
models.py fix(instances): lists show a VM that cannot be read as unknown 2026-10-05 11:03:32 +03:00
test_change_network.py fix(instances): change the edited NIC instead of adding a new one 2026-10-04 01:08:11 +03:00
test_change_xml.py fix(instances): the XML editor saves only while the VM is shut off 2026-10-04 19:13:20 +03:00
test_clone_permission.py fix(instances): clone name and MAC read the same dhcpd.conf 2026-10-04 19:39:29 +03:00
test_console_listener.py fix(instances): only administrators choose where a console listens 2026-10-05 15:07:31 +03:00
test_console_rule.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_console_settings_access.py fix(instances): the page of a VM on an unreachable host points to the list 2026-10-05 12:32:42 +03:00
test_create_instance.py fix(instances): CD-ROM bus, USB controller and MACs of a new VM 2026-10-04 18:33:28 +03:00
test_create_rollback.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_destroy.py fix(instances): destroy and volume delete no longer lose disks 2026-10-04 01:08:11 +03:00
test_detail_unreachable.py fix(instances): the page of a VM on an unreachable host points to the list 2026-10-05 12:32:42 +03:00
test_disk_isolation.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_error_handling.py fix(instances): failures reach the user; no redirect to other sites 2026-10-04 12:23:54 +03:00
test_gstfsd.py fix: stop ignoring SIGCHLD process-wide 2026-10-04 13:40:53 +03:00
test_index.py fix(instances): guard mutations and refresh lists after sync 2026-09-28 14:56:19 +03:00
test_index_host_alerts.py fix(instances): host errors on the instance list are for administrators 2026-10-05 11:49:46 +03:00
test_list_rpc.py perf(instances): instance lists read a VM's info once per row 2026-10-05 10:17:47 +03:00
test_list_unreachable.py fix(instances): lists show a VM that cannot be read as unknown 2026-10-05 11:03:32 +03:00
test_live_clone.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_create.py fix(instances): CD-ROM bus, USB controller and MACs of a new VM 2026-10-04 18:33:28 +03:00
test_live_dataloss.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_guest.py test(instances): the guest sees the hardware WebVirtCloud configures 2026-10-04 16:39:02 +03:00
test_live_iso.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_xml.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_live_xml_effects.py fix(instances): disk and agent channel changes on paused VMs 2026-10-04 17:10:49 +03:00
test_quota.py fix(instances): the page of a VM on an unreachable host points to the list 2026-10-05 12:32:42 +03:00
test_quota_lock.py fix(instances): disk edits keep their XML; changes lock per VM 2026-10-04 01:08:11 +03:00
test_root_pass.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_security_mutations.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_template_flag.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
test_update_console.py feat(console): VNC is the only console type 2026-10-04 01:08:11 +03:00
test_xss.py chore: drop references to the local roadmap from code and tests 2026-10-04 11:09:25 +03:00
tests.py feat(console): VNC is the only console type 2026-10-04 01:08:11 +03:00
urls.py fix: add an authorization matrix test and close the endpoints it finds 2026-10-02 20:33:12 +03:00
utils.py fix(instances): the quota counts every VM and refuses what it cannot verify 2026-10-05 12:26:57 +03:00
views.py fix(instances): only administrators choose where a console listens 2026-10-05 15:07:31 +03:00