Merge 1ca123b612 into 3800764639

proxstar/__init__.py

@@ -412,6 +412,9 @@ def vm_renew(vmid):
 @app.route('/vm/<string:vmid>/disk/create/<int:size>', methods=['POST'])
 @auth.oidc_auth
 def create_disk(vmid, size):
+    ## are they trying to disk with zero size
+    if size <= 0:
+        return '', 400
     user = User(session['userinfo']['preferred_username'])
     connect_proxmox()
     if user.rtp or int(vmid) in user.allowed_vms:
@@ -563,13 +566,12 @@ def set_boot_order(vmid):
         return '', 403
 
 
-@app.route('/vm/create', methods=['GET', 'POST'])
+@app.route('/vm/create', methods=['GET'])
 @auth.oidc_auth
-def create():
+def get_create():
     user = User(session['userinfo']['preferred_username'])
     proxmox = connect_proxmox()
     if user.active or user.rtp:
-        if request.method == 'GET':
         stored_isos = get_isos(proxmox, app.config['PROXMOX_ISO_STORAGE'])
         pools = get_pools(proxmox, db)
         for pool in get_shared_pools(db, user.name, True):
@@ -585,12 +587,28 @@ def create():
             pools=pools,
             templates=templates,
         )
-        elif request.method == 'POST':
+    else:
+        return '', 403
+
+
+@app.route('/vm/create', methods=['POST'])
+@auth.oidc_auth
+def create():
+    user = User(session['userinfo']['preferred_username'])
+    if user.active or user.rtp:
         name = request.form['name'].lower()
         cores = request.form['cores']
         memory = request.form['mem']
-            template = request.form['template']
         disk = request.form['disk']
+        username = request.form['user']
+        ## CHECK STUFF DEAR GOD
+        if int(cores) <= 0 or int(memory) <= 0 or int(disk) <= 0 or user == '':
+            return (
+                'VM creation with cores and/or mem and/or disk values that are less than 0',
+                400,
+            )
+
+        template = request.form['template']
         iso = request.form['iso']
         ssh_key = request.form['ssh_key']
         if iso != 'none':
@@ -603,7 +621,6 @@ def create():
             username = user.name
         else:
             usage_check = None
-                username = request.form['user']
         if usage_check:
             return usage_check
         else:
@@ -636,7 +653,6 @@ def create():
                     )
                     return '', 200
         return '', 200
-        return None
     else:
         return '', 403
 

proxstar/static/js/script.js

@@ -238,12 +238,21 @@ $("#create-vm").click(function(){
         if (name && disk) {
             if (template != 'none' && !ssh_regex.test(ssh_key)) {
                 swal("Uh oh...", "Invalid SSH key!", "error");
+            // MAXIMUM BOUNDS CHECK
             } else if (disk > max_disk) {
                 swal("Uh oh...", `You do not have enough disk resources available! Please lower the VM disk size to ${max_disk}GB or lower.`, "error");
             } else if (template != 'none' && cores > max_cpu) {
                 swal("Uh oh...", `You do not have enough CPU resources available! Please lower the VM cores to ${max_cpu} or lower.`, "error");
             } else if (template != 'none' && mem/1024 > max_mem) {
                 swal("Uh oh...", `You do not have enough memory resources available! Please lower the VM memory to ${max_mem}GB or lower.`, "error");
+            // MINIMUM BOUNDS CHECK
+            else if(0 <= disk){
+              swal("Uh oh...", `Selected disk size is less than 0.`,"error");
+            }else if(0 <= cores){
+              swal("Uh oh...", `Selected cores amount is less than 0.`,"error");
+            }else if(0 <= mem){
+              swal("Uh oh...", `Selected memory size is less than 0.`,"error");
+            }
             } else {
                 fetch(`/hostname/${name}`, {
                     credentials: 'same-origin',