Updating an image by adding or replacing 'id' returns a 200 response

[Luke Wollney]

Overview:
When a user attempts to update an image by adding 'id' as an image property, a 200 response is returned.

Steps to reproduce:
1) Create an image
2) Update the image via PATCH /images/<id> passing '[{"path": "/id", "value": "00000000-0000-0000-0000-000000000000", "op": "add"}]'
3) Notice that a 200 accepted response is returned even though the image does not appear to be updated

Expected:
A 403 response should be returned

Actual:
A 200 response is returned and the image does not appear to be updated

[Luke Wollney (luke-wollney)]

I have updated the title of this bug as updating an image by adding or replacing 'id' returns a 200. I would think that both requests should return a 403.

[Nikhil Komawar (nikhil-komawar)]

Any update on this?

[Stuart McLaren (stuart-mclaren)]

@flwang

Is it ok if I re-assign this bug?

[Stuart McLaren (stuart-mclaren)]

https://review.openstack.org/#/c/199104/

[Feilong Wang (flwang)]

@stuart-mclaren, no problem :)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/199104
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=e21a1d659fcb94d8f42a022dff5c3ed1e50c1923
Submitter: Jenkins
Branch: master

commit e21a1d659fcb94d8f42a022dff5c3ed1e50c1923
Author: Niall Bunting <email address hidden>
Date: Tue Jul 7 13:46:45 2015 +0000

    Make 'id' a read only property for v2

    Currently updating 'id' via v2 api returns 200 and inserts a new id
    property in the user defined properties. This change makes the 'id'
    behaviour consistent with other read only properties ie. size and owner.

    Change-Id: Id728be86bc5a8f768a5687cb5c52054c8ed232ac
    Closes-bug: 1439808