mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
f3929b8e8f
A VM owner who may manage the console (is_change and is_vnc) could set its listen address to all interfaces and remove its password: a VNC console reachable from the network without a password. Checked on a test host: the owner's form changed the VM's listen address to 0.0.0.0 and then removed the password. - The listen address field is disabled for users who are not superusers; a disabled field ignores posted values. They can still set or change the password and the keymap. - A console whose persistent definition does not bind it to loopback (or a Unix socket) only loses its password through an administrator. A binding the XML does not pin down counts as not local: listen type network, or no address (the host's default in qemu.conf). On the test host, the owner's form now leaves the listen address alone and is refused when it removes the password of a console listening on 0.0.0.0; with the console on localhost the password can be removed. The new tests fail on the previous code. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| connection.py | ||
| create.py | ||
| hostdetails.py | ||
| instance.py | ||
| interface.py | ||
| libvirt-ssh | ||
| network.py | ||
| nwfilters.py | ||
| rwlock.py | ||
| storage.py | ||
| test_change_network.py | ||
| test_connection.py | ||
| test_console_setters.py | ||
| test_iso_media.py | ||
| test_live_connection.py | ||
| test_network_ip.py | ||
| test_persistent_edits.py | ||
| test_resize_disk.py | ||
| test_rwlock.py | ||
| test_util.py | ||
| test_xml_safety.py | ||
| util.py | ||
| virtsecrets.py | ||