Security Bug: No external Connections

.gitignore

@@ -4,3 +4,6 @@ venv
 .DS_*
 *.pyc
 db.sqlite3
+console/cert.pem
+tags
+dhcpd.*

README.md

@@ -22,7 +22,7 @@ WebVirtCloud is a virtualization web interface for admins and users. It can dele
 ### Install WebVirtCloud panel (Ubuntu)
 
 ```bash
-sudo apt-get -y install git python-virtualenv python-dev libxml2-dev libvirt-dev zlib1g-dev nginx supervisor libsasl2-modules
+sudo apt-get -y install git python-virtualenv python-dev libxml2-dev libvirt-dev zlib1g-dev nginx supervisor libsasl2-modules gcc pkg-config
 git clone https://github.com/retspen/webvirtcloud
 cd webvirtcloud
 sudo cp conf/supervisor/webvirtcloud.conf /etc/supervisor/conf.d
@@ -185,6 +185,12 @@ webvirtcloud                     RUNNING    pid 24185, uptime 2:59:14
 
 ```
 
+#### Apache mod_wsgi configuration
+```
+WSGIDaemonProcess webvirtcloud threads=2 maximum-requests=1000 display-name=webvirtcloud
+WSGIScriptAlias / /srv/webvirtcloud/webvirtcloud/wsgi.py
+```
+
 #### Install final required packages for libvirtd and others on Host Server
 ```bash
 wget -O - https://clck.ru/9V9fH | sudo sh

accounts/backends.py

@@ -0,0 +1,7 @@
+from django.contrib.auth.backends import RemoteUserBackend
+
+class MyRemoteUserBackend(RemoteUserBackend):
+    def configure_user(self, user):
+        user.is_superuser = True
+        return user
+

accounts/forms.py

@@ -2,13 +2,14 @@
 from django import forms
 from django.utils.translation import ugettext_lazy as _
 from django.contrib.auth.models import User
+from django.conf import settings
 
 
 class UserAddForm(forms.Form):
     name = forms.CharField(label="Name",
                            error_messages={'required': _('No User name has been entered')},
                            max_length=20)
-    password = forms.CharField(required=True, error_messages={'required': _('No password has been entered')},)
+    password = forms.CharField(required=not settings.ALLOW_EMPTY_PASSWORD, error_messages={'required': _('No password has been entered')},)
 
     def clean_name(self):
         name = self.cleaned_data['name']

accounts/migrations/0004_userattributes.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import models, migrations
+from django.conf import settings
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('accounts', '0003_usersshkey'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='UserAttributes',
+            fields=[
+                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
+                ('max_instances', models.IntegerField(default=0)),
+                ('max_cpus', models.IntegerField(default=0)),
+                ('max_memory', models.IntegerField(default=0)),
+                ('user', models.OneToOneField(to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+    ]

accounts/migrations/0005_userattributes_can_clone_instances.py

@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import models, migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0004_userattributes'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='userattributes',
+            name='can_clone_instances',
+            field=models.BooleanField(default=False),
+        ),
+    ]

accounts/migrations/0006_userattributes_max_disk_size.py

@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import models, migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0005_userattributes_can_clone_instances'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='userattributes',
+            name='max_disk_size',
+            field=models.IntegerField(default=0),
+        ),
+    ]

accounts/migrations/0007_auto_20160426_0635.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0006_userattributes_max_disk_size'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='userattributes',
+            name='max_cpus',
+            field=models.IntegerField(default=1),
+        ),
+        migrations.AlterField(
+            model_name='userattributes',
+            name='max_disk_size',
+            field=models.IntegerField(default=20),
+        ),
+        migrations.AlterField(
+            model_name='userattributes',
+            name='max_instances',
+            field=models.IntegerField(default=1),
+        ),
+        migrations.AlterField(
+            model_name='userattributes',
+            name='max_memory',
+            field=models.IntegerField(default=2048),
+        ),
+    ]

accounts/migrations/0008_merge.py

@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0004_userinstance_is_vnc'),
+        ('accounts', '0007_auto_20160426_0635'),
+    ]
+
+    operations = [
+    ]

accounts/models.py

@@ -21,3 +21,14 @@ class UserSSHKey(models.Model):
 
     def __unicode__(self):
         return self.keyname
+
+class UserAttributes(models.Model):
+    user = models.OneToOneField(User, on_delete=models.CASCADE)
+    can_clone_instances = models.BooleanField(default=False)
+    max_instances = models.IntegerField(default=1)
+    max_cpus = models.IntegerField(default=1)
+    max_memory = models.IntegerField(default=2048)
+    max_disk_size = models.IntegerField(default=20)
+
+    def __unicode__(self):
+        return self.user.username

accounts/templates/accounts.html

@@ -71,6 +71,48 @@ <h4 class="modal-title">{% trans "Edit user info" %}</h4>
                                                     <input type="password" name="user_pass" class="form-control" value="">
                                                 </div>
                                             </div>
+                                            <div class="form-group">
+                                                <label class="col-sm-4 control-label">{% trans "Is staff" %}</label>
+                                                <div class="col-sm-2">
+                                                    <input type="checkbox" name="user_is_staff" {% if user.is_staff %}checked{% endif %}>
+                                                </div>
+                                            </div>
+                                            <div class="form-group">
+                                                <label class="col-sm-4 control-label">{% trans "Is superuser" %}</label>
+                                                <div class="col-sm-2">
+                                                    <input type="checkbox" name="user_is_superuser" {% if user.is_superuser %}checked{% endif %}>
+                                                </div>
+                                            </div>
+                                            <div class="form-group">
+                                                <label class="col-sm-4 control-label">{% trans "Can clone instances" %}</label>
+                                                <div class="col-sm-2">
+                                                    <input type="checkbox" name="userattributes_can_clone_instances" {% if user.userattributes.can_clone_instances %}checked{% endif %}>
+                                                </div>
+                                            </div>
+                                            <div class="form-group">
+                                                <label class="col-sm-4 control-label">{% trans "Max instances" %}</label>
+                                                <div class="col-sm-6">
+                                                    <input type="text" name="userattributes_max_instances" class="form-control" value="{{ user.userattributes.max_instances }}">
+                                                </div>
+                                            </div>
+                                            <div class="form-group">
+                                                <label class="col-sm-4 control-label">{% trans "Max cpus" %}</label>
+                                                <div class="col-sm-6">
+                                                    <input type="text" name="userattributes_max_cpus" class="form-control" value="{{ user.userattributes.max_cpus }}">
+                                                </div>
+                                            </div>
+                                            <div class="form-group">
+                                                <label class="col-sm-4 control-label">{% trans "Max memory (MB)" %}</label>
+                                                <div class="col-sm-6">
+                                                    <input type="text" name="userattributes_max_memory" class="form-control" value="{{ user.userattributes.max_memory }}">
+                                                </div>
+                                            </div>
+                                            <div class="form-group">
+                                                <label class="col-sm-4 control-label">{% trans "Max disk size (GB)" %}</label>
+                                                <div class="col-sm-6">
+                                                    <input type="text" name="userattributes_max_disk_size" class="form-control" value="{{ user.userattributes.max_disk_size }}">
+                                                </div>
+                                            </div>
                                     </div>
                                     <div class="modal-footer">
                                         <button type="submit" class="pull-left btn btn-danger" name="delete">
@@ -99,4 +141,4 @@ <h4 class="modal-title">{% trans "Edit user info" %}</h4>
                     {% endfor %}
                 {% endif %}
             </div>
-{% endblock %}
+{% endblock %}

accounts/templates/create_user_block.html

@@ -23,7 +23,7 @@ <h4 class="modal-title">{% trans "Add New User" %}</h4>
                         <div class="form-group">
                             <label class="col-sm-4 control-label">{% trans "Password" %}</label>
                             <div class="col-sm-6">
-                                <input type="password" class="form-control" name="password" placeholder="*******" required>
+                                <input type="password" class="form-control" name="password" placeholder="*******" {% if not allow_empty_password %}required{% endif %}>
                             </div>
                         </div>
                 </div>
@@ -35,4 +35,4 @@ <h4 class="modal-title">{% trans "Add New User" %}</h4>
             </div> <!-- /.modal-content -->
         </div> <!-- /.modal-dialog -->
     </div> <!-- /.modal -->
-{% endif %}
+{% endif %}

accounts/views.py

@@ -3,18 +3,19 @@
 from django.core.urlresolvers import reverse
 from django.utils.translation import ugettext_lazy as _
 from django.contrib.auth.models import User
-from accounts.models import UserInstance, UserSSHKey
+from django.contrib.auth.decorators import login_required
+from accounts.models import *
 from instances.models import Instance
 from accounts.forms import UserAddForm
+from django.conf import settings
 
 
+@login_required
 def profile(request):
     """
     :param request:
     :return:
     """
-    if not request.user.is_authenticated():
-        return HttpResponseRedirect(reverse('index'))
 
     error_messages = []
     user = User.objects.get(id=request.user.id)
@@ -63,21 +64,28 @@ def profile(request):
             return HttpResponseRedirect(request.get_full_path())
     return render(request, 'profile.html', locals())
 
-
+@login_required
 def accounts(request):
     """
     :param request:
     :return:
     """
 
-    if not request.user.is_authenticated():
-        return HttpResponseRedirect(reverse('index'))
+    def create_missing_userattributes(users):
+        for user in users:
+            try:
+                userattributes = user.userattributes
+            except UserAttributes.DoesNotExist:
+                userattributes = UserAttributes(user=user)
+                userattributes.save()
 
     if not request.user.is_superuser:
         return HttpResponseRedirect(reverse('index'))
 
     error_messages = []
-    users = User.objects.filter(is_staff=False, is_superuser=False)
+    users = User.objects.all().order_by('username')
+    create_missing_userattributes(users)
+    allow_empty_password = settings.ALLOW_EMPTY_PASSWORD
 
     if request.method == 'POST':
         if 'create' in request.POST:
@@ -96,7 +104,17 @@ def accounts(request):
             user_pass = request.POST.get('user_pass', '')
             user_edit = User.objects.get(id=user_id)
             user_edit.set_password(user_pass)
+            user_edit.is_staff = request.POST.get('user_is_staff', False)
+            user_edit.is_superuser = request.POST.get('user_is_superuser', False)
             user_edit.save()
+
+            userattributes = user_edit.userattributes
+            userattributes.can_clone_instances = request.POST.get('userattributes_can_clone_instances', False)
+            userattributes.max_instances = request.POST.get('userattributes_max_instances', 0)
+            userattributes.max_cpus = request.POST.get('userattributes_max_cpus', 0)
+            userattributes.max_memory = request.POST.get('userattributes_max_memory', 0)
+            userattributes.max_disk_size = request.POST.get('userattributes_max_disk_size', 0)
+            userattributes.save()
             return HttpResponseRedirect(request.get_full_path())
         if 'block' in request.POST:
             user_id = request.POST.get('user_id', '')
@@ -123,22 +141,20 @@ def accounts(request):
     return render(request, 'accounts.html', locals())
 
 
+@login_required
 def account(request, user_id):
     """
     :param request:
     :return:
     """
 
-    if not request.user.is_authenticated():
-        return HttpResponseRedirect(reverse('index'))
-
     if not request.user.is_superuser:
         return HttpResponseRedirect(reverse('index'))
 
     error_messages = []
     user = User.objects.get(id=user_id)
     user_insts = UserInstance.objects.filter(user_id=user_id)
-    instances = Instance.objects.all()
+    instances = Instance.objects.all().order_by('name')
 
     if user.username == request.user.username:
         return HttpResponseRedirect(reverse('profile'))
@@ -162,12 +178,17 @@ def account(request, user_id):
             return HttpResponseRedirect(request.get_full_path())
         if 'add' in request.POST:
             inst_id = request.POST.get('inst_id', '')
-            try:
-                check_inst = UserInstance.objects.get(instance_id=int(inst_id))
+
+            if settings.ALLOW_INSTANCE_MULTIPLE_OWNER:
+                check_inst = UserInstance.objects.filter(instance_id=int(inst_id), user_id=int(user_id))
+            else:
+                check_inst = UserInstance.objects.filter(instance_id=int(inst_id))
+
+            if check_inst:
                 msg = _("Instance already added")
                 error_messages.append(msg)
-            except UserInstance.DoesNotExist:
-                add_user_inst = UserInstance(instance_id=int(inst_id), user_id=user_id)
+            else:
+                add_user_inst = UserInstance(instance_id=int(inst_id), user_id=int(user_id))
                 add_user_inst.save()
                 return HttpResponseRedirect(request.get_full_path())
 

computes/forms.py

@@ -149,6 +149,8 @@ def clean_hostname(self):
 class ComputeAddSocketForm(forms.Form):
     name = forms.CharField(error_messages={'required': _('No hostname has been entered')},
                            max_length=20)
+    details = forms.CharField(error_messages={'required': _('No details has been entred')},
+                           max_length=50)
 
     def clean_name(self):
         name = self.cleaned_data['name']