User gets logged out when editing a snapshot

[Ayman Mafarja]

Procedure:
1- Go Project -> Compute -> Instances.
2- Create a snapshot of any instance.
3- Go to the newly created snapshot raw in Project -> Compute -> Images.
4- Edit Image -> change disk format to another format, e.g, "ISO".
5- The user logs out directly.

Note: Even admin user faces the same issue.

After analyzing the issue, I found that a "Forbidden HTTP request (403)" is thrown if any user tries to edit the "disk format" attribute if the image is not in "queued" status even though queued images cannot be edited. And that, in turn, logs user out.

Editing disk format of any image won't really change its format. So, it might be true to have an error message when editing disk format attribute. If the case of Forbidden HTTP request is not correct, we can throw any other exception indicating that the content cannot be changed.

I have the version 3.15.0 of openstack.

[Ayman Mafarja (amafarja)]

Code Review: https://review.openstack.org/#/c/569635

[Brian Rosmaita (brian-rosmaita)]

This is not a valid glance bug. Once the image data is set, no one is allowed to change the disk_format, container_format, size, or checksum. This is by design. It is particularly the case for snapshots, where Nova knows exactly what it is dealing with and will set the disk_format and container_format correctly.

Additionally, it is possible to change the disk_format and container_format on images in 'queued' status using the Image API.

[Ayman Mafarja (amafarja)]

Hi Brian,

Yes, changing disk format is not allowed. But when a user changes the disk format of an image, an error message pops up and he gets LOGGED OUT. That is the point, users shouldn't be logged out when updating that field. That should be handled in a different behavior, e.g, by getting an error message and keeping the user logged in.

[Brian Rosmaita (brian-rosmaita)]

This is not a valid Glance bug. Glance does not have a concept of "logging in", you interact with glance by presenting a token obtained from keystone as a header when you make an API call. Glance does not log a user out. This has to be fixed in Horizon.

[Abhishek Kekane (abhishek-kekane)]

This is something that needs to be fixed in horizon IMO.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Brian Rosmaita (<email address hidden>) on branch: master
Review: https://review.openstack.org/569635
Reason: This patch is for an invalid bug in glance.

[shlomi medini (shlomi23)]

I have the sane issue ( running with Centos 7.5 and openstack Queens )
Also when changing an image which is not a snapshot I get logged out .
The fix should be in Horizon to popup a warning message for example and not log out the user .

[Akihiro Motoki (amotoki)]

From the point of view of horizon, the menu of "Format" should be hidden considering the fact that it is not allowed to change the image format.