Merge lp:~corey.bryant/horizon/2014.2.2 into lp:~ubuntu-server-dev/horizon/juno

[Corey Bryant]

=== modified file 'debian/changelog'
--- debian/changelog	2014-12-09 20:01:52 +0000
+++ debian/changelog	2015-02-05 20:50:36 +0000
@@ -1,3 +1,27 @@
+horizon (1:2014.2.2-0ubuntu1) UNRELEASED; urgency=medium
+
+  * Resynchronize with stable/juno (697888b) (LP: #1418695):
+    - [889f9d9] Update project limits when using input selector
+    - [be88d14] Update project limits when flavor changes
+    - [0723e70] Fix metering daily display
+    - [5603578] Fix Horizon crash when parsing volume list
+    - [e100279] Only enable one images filter button
+    - [60d01cc] add missing icons for Project > Images filter
+    - [8a717d9] Fix sorting by size for Project->Images table
+    - [070771b] removing mandatory mark for post_creation tab
+    - [9120a7f] Removing Moscow's timezone check
+    - [e8a66a4] Horizon login page contains DOS attack mechanism
+    - [962a0a7] Fix popup error when volume service disabled
+    - [bcac1a8] Gracefully handle failures to retrieve a flavor
+    - [2cd9435] Return eye-icon to its place when validation message is shown
+    - [9b11e2e] Fix timezones in line chart
+    - [bca0f47] Disable router HA attribute due to Neutron bug
+    - [b2dc30d] Remove glyphicon-eye-open icon from Description
+    - [697888b] Remove selenium dependency when not using selenium tests
+  * d/p/prevent_login_page_DOS.patch: Dropped. Fix is now upstream.
+
+ -- Corey Bryant <[e-mail]>  Thu, 05 Feb 2015 15:24:25 -0500
+
 horizon (1:2014.2.1-0ubuntu2) utopic; urgency=medium
 
   [ Corey Bryant ]

=== removed file 'debian/patches/prevent_login_page_DOS.patch'
--- debian/patches/prevent_login_page_DOS.patch	2014-12-09 18:42:24 +0000
+++ debian/patches/prevent_login_page_DOS.patch	1970-01-01 00:00:00 +0000
@@ -1,62 +0,0 @@
-From 09b8f8f6724dd7eb8b34fd4c2c2e66b0a3d0cab9 Mon Sep 17 00:00:00 2001
-From: eric <[e-mail]>
-Date: Thu, 20 Nov 2014 08:49:09 -0700
-Subject: [PATCH] Horizon login page contains DOS attack mechanism
-
-the horizon login page (really the middleware) accesses the session
-too early in the login process, which will create session records
-in the session backend.  This is especially problematic when non-cookie
-backends are used.
-
-Change-Id: I9d2c40403fb9b0cfb512f2ff45397cbe0b050c71
-Closes-Bug: 1394370
----
- horizon/middleware.py        | 10 ++++++----
- openstack_dashboard/views.py |  5 ++---
- 2 files changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/horizon/middleware.py b/horizon/middleware.py
-index a0d9c3d..885489e 100644
---- a/horizon/middleware.py
-+++ b/horizon/middleware.py
-@@ -90,16 +90,18 @@ class HorizonMiddleware(object):
-         request.horizon = {'dashboard': None,
-                            'panel': None,
-                            'async_messages': []}
-+        if not hasattr(request, "user") or not request.user.is_authenticated():
-+            # proceed no further if the current request is already known
-+            # not to be authenticated
-+            # it is CRITICAL to perform this check as early as possible
-+            # to avoid creating too many sessions
-+            return None
- 
-         # Check for session timeout if user is (or was) authenticated.
-         has_timed_out, timestamp = self._check_has_timed_timeout(request)
-         if has_timed_out:
-             return self._logout(request, request.path, _("Session timed out."))
- 
--        if not hasattr(request, "user") or not request.user.is_authenticated():
--            # proceed no further if the current request is already known
--            # not to be authenticated
--            return None
-         if request.is_ajax():
-             # if the request is Ajax we do not want to proceed, as clients can
-             #  1) create pages with constant polling, which can create race
-diff --git a/openstack_dashboard/views.py b/openstack_dashboard/views.py
-index 4ce55ff..0473279 100644
---- a/openstack_dashboard/views.py
-+++ b/openstack_dashboard/views.py
-@@ -41,8 +41,7 @@ def splash(request):
-         response = shortcuts.redirect(horizon.get_user_home(request.user))
-     else:
-         form = forms.Login(request)
--        request.session.clear()
--        request.session.set_test_cookie()
-         response = shortcuts.render(request, 'splash.html', {'form': form})
--    response.delete_cookie('logout_reason')
-+    if 'logout_reason' in request.COOKIES:
-+        response.delete_cookie('logout_reason')
-     return response
--- 
-2.1.0
-

=== modified file 'debian/patches/series'
--- debian/patches/series	2014-12-09 18:42:24 +0000
+++ debian/patches/series	2015-02-05 20:50:36 +0000
@@ -1,4 +1,3 @@
-prevent_login_page_DOS.patch
 fix-dashboard-django-wsgi.patch
 fix-dashboard-manage.patch
 ubuntu_settings.patch