Also, from my assessment of the code, this particular bug potentially goes back a very long way to when the registry and api code were first integrated in commit fba60c3a588ccbae61e3ba8cf6558efc36d116a5 on December 13 2010.
However, it is also possible that authorization checking code was removed from glance.store at some point. I haven't been able to track that down yet.
Also, from my assessment of the code, this particular bug potentially goes back a very long way to when the registry and api code were first integrated in commit fba60c3a588ccba e61e3ba8cf6558e fc36d116a5 on December 13 2010.
However, it is also possible that authorization checking code was removed from glance.store at some point. I haven't been able to track that down yet.