It is now possible to set created_at and updated_at on POST

[git-harry]

https://review.openstack.org/#/c/426278/ has introduced a bug whereby it is possible to set the values for created_at and updated_at in POST requests and potentially other types of request. This appears to be the result of the way filters and validators sometimes share schemata in schemas.py

[Sulochan Acharya (sulochan-acharya)]

It is also possible to set, id among other things. We need better separation of validators and filters to ensure we dont create a security hole.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/437606

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/437606
Committed: https://git.openstack.org/cgit/openstack/craton/commit/?id=78136334daea63214a895039b4deb7a72675fc0a
Submitter: Jenkins
Branch: master

commit 78136334daea63214a895039b4deb7a72675fc0a
Author: Sulochan Acharya <email address hidden>
Date: Thu Feb 23 20:26:51 2017 +0000

    Ensures no extra property is allowed on creates

    Currently we have validators and filters that ensure
    certain propeties on GET/POST/PUT calls. So far we
    have been using the same schema for GET and POST calls
    as a result it was possible to post id, created_at etc
    when creating resources. This patch fixes this by dividing
    the schema to match get and creates.

    This adds black listed properties on creates, which can
    be expanded according to the resource in question in the
    future in needed.

    Functional tests are addded.

    Closes Bug: 1662848

    Change-Id: I9226c18187064b310c811164e146da4909295768