Commit af6220f5 by Bach Dániel

dashboard: add missing permission checks to __add_port()

parent 4e1f7ab1
...@@ -349,11 +349,18 @@ class VmDetailView(CheckedDetailView): ...@@ -349,11 +349,18 @@ class VmDetailView(CheckedDetailView):
try: try:
error = None error = None
host = Host.objects.get(pk=request.POST.get("host_pk")) interfaces = object.interface_set.all()
host = Host.objects.get(pk=request.POST.get("host_pk"),
interface__in=interfaces)
host.add_port(proto, private=port) host.add_port(proto, private=port)
except Host.DoesNotExist:
logger.error('Tried to add port to nonexistent host %d. User: %s. '
'Instance: %s', request.POST.get("host_pk"),
unicode(request.user), object)
raise PermissionDenied()
except ValueError: except ValueError:
error = _("There is a problem with your input!") error = _("There is a problem with your input!")
except Exception, e: except Exception as e:
error = u', '.join(e.messages) error = u', '.join(e.messages)
if request.is_ajax(): if request.is_ajax():
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or sign in to comment