An error occurred while fuel plugin removing with plugin multiversioning

[Alexey Galkin]

Detailed bug description:
 Fuel allows you to install plugins have the same version but different versions of the packages (for example: http://paste.openstack.org/raw/Zw0kkYvUPnrQ4V5TxGD0/), but when you try to remove the plug-in returns an error: http://paste.openstack.org/raw/TY7bjKfMDQdzZJR5EorE/ .

Steps to reproduce:
 1. Create a new fuel plugin with version=1.0.0 and package_version=2.0.0.
 2. Create a new fuel plugin with version=1.0.0 and package_version=4.0.0.
 3. Upload to master node and install it.
 4. Remove one of this plugins.

Expected results:
 Successfully removing one (or all) of this plugins.

Actual result:
 Plugins are not removed and an error message is caused by: http://paste.openstack.org/raw/TY7bjKfMDQdzZJR5EorE/

Reproducibility:
 On all fuel enviroments.

Workaround:
 Remove rpm package from system and mirrors. Remove record allocated with plugin from database.

Impact:
 This is a serious bug containing a potential vulnerability through which an attacker can get partial information from the database.

Description of the environment:
 Operation system: Linux fuel.domain.tld 3.10.0-229.20.1.el7.x86_64 #1 SMP Tue Nov 3 19:10:07 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
 Versions of components: 9.0
 Shotgun2 report: http://paste.openstack.org/raw/i4KcmfeZH4WBaIjcnnCz/
 Reference architecture: -
 Network model: -
 Related projects installed: fuel-plugins, nailgun

Additional information:
 It is very unsafe to show such detailed error messages, probably necessary implement debug mode which will display a detailed error reports.

[Dmitry Pyzhov (dpyzhov)]

I don't see how this bug can be exploited by anyone who cannot get root access without this hack. Removing the 'private security' tag.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/303573
Committed: https://git.openstack.org/cgit/openstack/fuel-web/commit/?id=68a8e258d7d35caea6eed2d1643a4b5ea4b758ea
Submitter: Jenkins
Branch: master

commit 68a8e258d7d35caea6eed2d1643a4b5ea4b758ea
Author: Ilya Kutukov <email address hidden>
Date: Fri Apr 8 21:36:41 2016 +0300

    Deployment graphs are deleted together with parent entity

    When Release, Plugin or Cluster is deleted, related
    deployment graphs are deleted as well.

    Note, that current DeploymentGraph deletion schema works if
    DeploymentGraph have only relation to parent
    otherwise unwanted relations may be affected by graph cleanup.

    Change-Id: If489879a3d4ca01ba2335dd279136c57e1bad171
    Closes-Bug: #1567471
    Closes-Bug: #1557632

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/313013

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/313014

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ilya Kutukov (<email address hidden>) on branch: master
Review: https://review.openstack.org/313013

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ilya Kutukov (<email address hidden>) on branch: stable/mitaka
Review: https://review.openstack.org/313014

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/315687

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/315687
Committed: https://git.openstack.org/cgit/openstack/fuel-web/commit/?id=3cd17b967a1703953e7af9bbb91701adad525a4c
Submitter: Jenkins
Branch: stable/mitaka

commit 3cd17b967a1703953e7af9bbb91701adad525a4c
Author: Ilya Kutukov <email address hidden>
Date: Fri Apr 8 21:36:41 2016 +0300

    Deployment graphs are deleted together with parent entity

    When Release, Plugin or Cluster is deleted, related
    deployment graphs are deleted as well.

    Note, that current DeploymentGraph deletion schema works if
    DeploymentGraph have only relation to parent
    otherwise unwanted relations may be affected by graph cleanup.

    Closes-Bug: #1567471
    Closes-Bug: #1557632
    Change-Id: If489879a3d4ca01ba2335dd279136c57e1bad171

[dkravchenko (dkravchenko)]

Verified on ISO #477 (I could not reproduce state with two installed instances of same plugin with same plugin_version, differs only by package_version, http://paste.openstack.org/show/516253/)