Abandon/adopt don't consider project

[Steven Hardy]

We don't include the project ID in the abandon data, but all resources being abandoned exist in a specific tenant/project, so while heat will allow you to adopt resources from another project, and the stack ends up ADOPT_COMPLETE, everything will break if you then try to do anything with the stack.

This is one aspect of the complete lack of data validation on adopt which we need to fix.

I've not found a specific exploit, but clearly this behaviour is undesirable and could be open to abuse. IMO we should restrict abandon/adopt to include the project_id and validate the scope of the request on adopt matches the project_id in the abandon data.

[Steven Hardy (shardy)]

An additional side-effect of this is if you adopt a stack with resources from another project, you can't delete it - you have to do stack-abandon to remove it from the DB.

That actually turns out to be a nicer way for folks to recover from the occasional DELETE_FAILED states which have occurred in the past due to bugs (e.g instead of having to fixup in the DB or drop everything)

[Steven Hardy (shardy)]

Bumping to J3 as no fix proposed.

Vijendar can you provide a status update on this please?

FWIW, part of proposing new features is sticking around to maintain them, which IMO has not happened in this case, which is pretty disappointing :(

[Vijendar Komalla (vijendar-komalla)]

sorry Steve, I did not get a chance to work on this. I will spend some time on this bug this week and update the status.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/110713

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/110714

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/110713
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=b27840a45dece1a9b58c2977a8bf6a1acec9002f
Submitter: Jenkins
Branch: master

commit b27840a45dece1a9b58c2977a8bf6a1acec9002f
Author: Vijendar Komalla <email address hidden>
Date: Tue Jul 29 13:57:16 2014 -0500

    Include project ID in stack abandon data

    This change adds stack project_id and stack_user_project_id to
    the stack abandon data, so that stack-adopt can check if
    the project_id provided in abandon data matches the tenant_id
    of the current user.

    Change-Id: If98db0a4a210965209d50f1b04208677f63c418d
    Partial-Bug: #1301314

[Zane Bitter (zaneb)]

Bumping from juno-rc1 in favour of bug 1375879.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Steve Baker (<email address hidden>) on branch: master
Review: https://review.openstack.org/110714
Reason: This is a very old review which has unaddressed review feedback, failing tests, or merge conflicts.

For this reason it is being abandoned to make the review queue more maintainable. It can be restored and refreshed at any time.