This commit https://review.openstack.org/#/c/99150 change 'show_image_direct_url' parameter to 'True', but paramer include the backend image storage location in image properties and revealing storage location can be a security risk, so use this setting with caution.
This is a potential vulnerability, for example consider the scenario:
We using a swift storage. Create image with new glance client (1.1.0), and receive message:
This commit https:/ /review. openstack. org/#/c/ 99150 change 'show_image_ direct_ url' parameter to 'True', but paramer include the backend image storage location in image properties and revealing storage location can be a security risk, so use this setting with caution.
This is a potential vulnerability, for example consider the scenario:
We using a swift storage. Create image with new glance client (1.1.0), and receive message:
+------ ------- -----+- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ----+ ------- -----+- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ----+ e19922dbed26314 00 | 11T10:18: 29Z | services% 3Aglance: EF3tluYM@ 192.168. 0.2:5000/ v2.0/glance/ 049cd701- 77 | ab04-4951a93df5 43 | 77f2-444b- ab04-4951a93df5 43 | 086879976e255c5 d8 | 14T20:38: 28Z | ------- -----+- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ----+
| Property | Value |
+------
| checksum | 10d838409df43a1
| container_format | bare |
| created_at | 2015-08-
| direct_url | swift+http://
| | f2-444b-
| disk_format | qcow2 |
| id | 049cd701-
| min_disk | 0 |
| min_ram | 0 |
| name | ubuntu14(dont use it) |
| owner | 8ba1c622b05e48d
| protected | False |
| size | 1725956096 |
| status | active |
| tags | [] |
| updated_at | 2015-08-
| visibility | public |
+------
On this step we have a glance user credentials. After this we can escalate any user to admin privileges using glance credentials by keystone client.