mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 19:56:48 +00:00
eb828b364d
create_storage_ceph and create_storage_netfs wrote the pool, host, user, secret and format values into the pool XML unescaped and unchecked: the page's patterns were the only guard, and a direct POST could break or extend the XML. The values now go through util.xml_escape, as the network code does. The page's host fields stopped at 20 characters, so nfs01.storage.example.com could not be typed: they take a host name's 253; the Ceph pool and user fields lose the limit the server never had. |
||
|---|---|---|
| .. | ||
| api | ||
| migrations | ||
| templates | ||
| tests | ||
| __init__.py | ||
| forms.py | ||
| jobs.py | ||
| models.py | ||
| upload.py | ||
| views.py | ||