Glance

  1. Bug #1400966
  2. Comment #9

Comment 9 for bug 1400966

Revision history for this message
Zhi Yan Liu (lzy-dev) wrote : Re: Glance allows users to download and delete any file in glance-api server

Hi Stuart, Hemanth,

Thanks for your analysis.

As an alternative solution regarding to changing store drive that Hemanth proposed above, I think we could make a similar limitation/check on image location update api like what we did in v1 [0] as well, to prevent user use patch api to handle file and swift location? A unique benefit of the way is that, IMO, it could make v2 api be consistent with v1 on this kind of request from client's perspective.

[0] https://github.com/openstack/glance/blob/master/glance/api/v1/images.py#L429

Thoughts?