Merge lp:~james-page/glance/folsom-resync into lp:~openstack-ubuntu-testing/glance/folsom

[James Page]

Resync of pending SRU with security updates

=== modified file 'debian/changelog'
--- debian/changelog	2013-03-21 15:36:24 +0000
+++ debian/changelog	2013-03-22 13:39:40 +0000
@@ -4,6 +4,16 @@
 
  -- Chuck Short <[e-mail]>  Thu, 21 Mar 2013 10:18:54 -0500
 
+glance (2012.2.3-0ubuntu2) quantal-proposed; urgency=low
+
+  * Resync with latest security update.
+  * SECURITY UPDATE: fix information disclosure via Glance v1 API
+    - debian/patches/CVE-2013-1840.patch: adjust api/middleware/cache.py to
+      not show image_meta['location']
+    - CVE-2013-1840
+
+ -- James Page <[e-mail]>  Fri, 22 Mar 2013 11:48:52 +0000
+
 glance (2012.2.3-0ubuntu1) quantal-proposed; urgency=low
 
   * Dropped patches, applied upstream:
@@ -18,6 +28,15 @@
 
  -- Adam Gandelman <[e-mail]>  Tue, 05 Feb 2013 14:02:33 -0400
 
+glance (2012.2.1-0ubuntu1.2) quantal-security; urgency=low
+
+  * SECURITY UPDATE: fix information disclosure via Glance v1 API
+    - debian/patches/CVE-2013-1840.patch: adjust api/middleware/cache.py to
+      not show image_meta['location']
+    - CVE-2013-1840
+
+ -- Jamie Strandboge <[e-mail]>  Wed, 13 Mar 2013 15:39:08 -0500
+
 glance (2012.2.1-0ubuntu1.1) quantal-security; urgency=low
 
   * SECURITY UPDATE: information disclosure via swift error messages

=== added file 'debian/patches/CVE-2013-1840.patch'
--- debian/patches/CVE-2013-1840.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/CVE-2013-1840.patch	2013-03-22 13:39:40 +0000
@@ -0,0 +1,22 @@
+commit 13eecc3e19e9528d52e71f57bd15b2cf6e0c1af2
+Author: Stuart McLaren <[e-mail]>
+Date:   Thu Mar 7 17:11:35 2013 +0000
+
+    folsom patch
+    
+    Change-Id: Ib0dbef4ce5d1aa5303f63d0aca635eee49e40284
+
+diff --git a/glance/api/middleware/cache.py b/glance/api/middleware/cache.py
+index 8e24ef0..dcd59b6 100644
+--- a/glance/api/middleware/cache.py
++++ b/glance/api/middleware/cache.py
+@@ -111,6 +111,9 @@ class CacheFilter(wsgi.Middleware):
+ 
+     def _process_v1_request(self, request, image_id, image_iterator):
+         image_meta = registry.get_image_metadata(request.context, image_id)
++        # Don't display location
++        if 'location' in image_meta:
++            del image_meta['location']
+ 
+         if not image_meta['size']:
+             # override image size metadata with the actual cached

=== modified file 'debian/patches/series'
--- debian/patches/series	2012-08-23 11:56:07 +0000
+++ debian/patches/series	2013-03-22 13:39:40 +0000
@@ -1,3 +1,4 @@
 sql_conn.patch
 disable-swift-tests.patch
 disable-network-for-docs.patch
+CVE-2013-1840.patch