Users (without admin privileges) can change ACTIVE_IMMUTABLE properties of their own images when deactivated.

[Alexey Galkin]

Steps to reproduce:

1. Create a new image with 'active' status.
2. Deactivate this image from admin. (image should have a 'deactivated' status)
3. Use this curl request:
curl -X PUT http://localhost:9292/v1/images/<USER_IMAGE_ID> -H 'X-Auth-Token: <USER_TOKEN>' -H 'x-image-meta-size: 1234567'
4. Verify that created image have a '1234567' size.

[wangxiyuan (wangxiyuan)]

I think it has no relate to 'deactivated' status.

Either 'active' or 'deactivated', users can both change the image's size through v1 API.

So maybe the problem is that size can be updated via v1 api.
We should reach an agreement that whether we should support it.

In v1, I see that image can be created with size input(only location and copy_from), but size can be changed with every image.

[Niall Bunting (niall-bunting)]

@wangxiyuan It seems to me when the image is activated you get 403 - Forbidden to modify 'size' of active image.

IMO we just need to make sure that this is also true of deactivated images.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/247532

[Erno Kuvaja (jokke)]

As per the deactivation spec only the image data is inaccessible during the deactivation. All the rest operations (that does not touch the actual image data) should work normally.

http://specs.openstack.org/openstack/glance-specs/specs/kilo/deactivate-image.html

[Erno Kuvaja (jokke)]

If these operations have been permitted on v2 api already we should revert those changes.

[Erno Kuvaja (jokke)]

Brain fart, I mean denied.

[Erno Kuvaja (jokke)]

So pulling back my previous comments. This bug enables user to set ACTIVE_IMMUTABLE properties of the deactivated images, which obviously should not be the case. Not just size but this affects all of the field that should be immutable after the image has transitioned active.

[wangxiyuan (wangxiyuan)]

@Niall, Sorry, I missed the"without admin privileges". You are right.

[Erno Kuvaja (jokke)]

This applies to all keys in ACTIVE_IMMUTABLE list.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/247532
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=fbe964a0f20b9ab708b85634c3d707630d403dcd
Submitter: Jenkins
Branch: master

commit fbe964a0f20b9ab708b85634c3d707630d403dcd
Author: NiallBunting <email address hidden>
Date: Thu Nov 19 14:02:06 2015 +0000

    Disallow user modifing ACTIVE_IMMUTABLE of deactivated images

    Currently the user can change the ACTIVE_IMMUTABLE properties whilst
    the image is 'deactivated'. This should not be the case once an image
    has become 'active'.

    APIImpact
    Change-Id: I744fbce90893008ef49568c3cba47bf0e26dec9d
    Closes-Bug: 1517060
    Closes-Bug: 1517963

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/248717

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/248723

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/248723
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=0f001b2f13ee0a16b09b0854164431239dad3b69
Submitter: Jenkins
Branch: stable/liberty

commit 0f001b2f13ee0a16b09b0854164431239dad3b69
Author: NiallBunting <email address hidden>
Date: Thu Nov 19 14:02:06 2015 +0000

    Disallow user modifing ACTIVE_IMMUTABLE of deactivated images

    Currently the user can change the ACTIVE_IMMUTABLE properties whilst
    the image is 'deactivated'. This should not be the case once an image
    has become 'active'.

    APIImpact
    Change-Id: I744fbce90893008ef49568c3cba47bf0e26dec9d
    Closes-Bug: 1517060
    Closes-Bug: 1517963
    (cherry picked from commit fbe964a0f20b9ab708b85634c3d707630d403dcd)

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/glance 12.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/248717
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=417c02ae8ae362713dc7c46740f1af7e2a9d55c2
Submitter: Jenkins
Branch: stable/kilo

commit 417c02ae8ae362713dc7c46740f1af7e2a9d55c2
Author: NiallBunting <email address hidden>
Date: Thu Nov 19 14:02:06 2015 +0000

    Disallow user modifing ACTIVE_IMMUTABLE of deactivated images

    Currently the user can change the ACTIVE_IMMUTABLE properties whilst
    the image is 'deactivated'. This should not be the case once an image
    has become 'active'.

    APIImpact
    Change-Id: I744fbce90893008ef49568c3cba47bf0e26dec9d
    Closes-Bug: 1517060
    Closes-Bug: 1517963
    (cherry picked from commit fbe964a0f20b9ab708b85634c3d707630d403dcd)

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/glance 11.0.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/glance 11.0.1 release.