Backport of CVE-2015-3219 fix into Horizon

[Timur Sufiev]

Title: XSS in Horizon Heat stack creation
Reporter: Nikita Konovalov (Mirantis)
Products: Horizon
Affects: 2014.2 versions through 2014.2.3 and version 2015.1.0

Description:
Nikita Konovalov from Mirantis reported a vulnerability in Horizon. By
tricking a Horizon user into using a malicious template in the
Orchestration/Stack section of Horizon, a remote attacker may trigger a
cross-site-scripting vulnerability during the stack creation. It may
result in potential assets theft like user access credentials. Only
setups exposing the orchestration dashboard in Horizon are affected.

Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to stable/juno, stable/kilo and master on the public
disclosure date.

CVE: CVE-2015-3219

Proposed public disclosure date/time:
2015-06-09, 1500UTC
Please do not make the issue public (or release public patches) before
this coordinated embargo date.

[Timur Sufiev (tsufiev-x)]

The fix being backported is at https://review.fuel-infra.org/#/c/7530/

[Timur Sufiev (tsufiev-x)]

Changing the status to Public Security because disclosure date had passed already.

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-6.0-updates/2014.2
Change author: Timur Sufiev <email address hidden>
Review: https://review.fuel-infra.org/7879

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-7.0/2015.1.0
Change author: Timur Sufiev <email address hidden>
Review: https://review.fuel-infra.org/8163

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/7879
Submitter: Alex Khivin <email address hidden>
Branch: openstack-ci/fuel-6.0-updates/2014.2

Commit: f3ebfbfc8fb7610ad90e4b1401911791efc437a1
Author: Timur Sufiev <email address hidden>
Date: Tue Jun 16 11:43:37 2015

[PATCH] Escape the description param from heat template

The heat template allows user to define custom parameters,
the fields are then converted to input fields. The description
param maps to the help_text attribute of the field.

Since the value comes from the user, the value must be escaped
before rendering.

Change-Id: I557f5143aafb246bdf838379e4b263a97db7a552
Closes-bug: #1462095
(cherry picked from commit dcd4729c2021514002dbf6967848b02fb6c04b84)

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Timur Sufiev <email address hidden> on branch: openstack-ci/fuel-7.0/2015.1.0
Review: https://review.fuel-infra.org/8163
Reason: According to https://docs.google.com/spreadsheets/d/1vF4Iah_ZfE69z2y-qP2cNxQ23Vzag2pknex4xzlRJBM/edit#gid=74888541