Murano image properties are unprotected

[Andy Botting]

Due to how Murano uses the murano_image_info glance property to determine what images to show to the user, it can be easily added by any user to insert their public image into the list of available images. This could potentially be used for malicious purposes in a public cloud.

We looked at using at Glance property protections, but this causes Glance to die when trying to snapshot a Murano instance, instead of just skipping the property, which is unacceptable.

In our situation, it would be really useful to be able to add custom image filters, especially to limit the list to images owned by a particular project.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/504833

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/504833
Committed: https://git.openstack.org/cgit/openstack/murano-dashboard/commit/?id=09110be37ed524794d3622afb6bb55387313a619
Submitter: Zuul
Branch: master

commit 09110be37ed524794d3622afb6bb55387313a619
Author: Andy Botting <email address hidden>
Date: Mon Sep 18 11:33:30 2017 +1000

    Allow images to be filtered by project ID

    A new parameter MURANO_IMAGE_FILTER_PROJECT_ID has been added which, when
    given, will filter the list of public Murano images to the given project
    ID. Private images owned by the user are also included.

    Change-Id: I20ad609e48cc786f46214efc0d308b8d1b0f6ea9
    Closes-Bug: #1717439

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/murano-dashboard 5.0.0.0b2 development milestone.