lp:ubuntu/quantal-proposed/glance

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #1065187: [OSSA-2012-017] Non-admin users can cause public glance images to be deleted

Critical

Fix Committed

Link a bug report

Related blueprints

65. By Adam Gandelman on 2013-04-25

[ Adam Gandelman ]
* Dropped patches, applied upstream:
  - debian/patches/CVE-2013-1840.patch: [dd849a9]
* Resynchronize with stable/folsom (dbd3d3d7) (LP: #1179707):
  - [cfaa2d8] repeated deletion on image member does not result in 404
    LP: 1157427
  - [5b4d21d] glance-cache-prefetcher explodes when no auth parameters were
    configured LP: 1157765
  - [dd849a9] v1 api returns location as header for cached images LP: 1135541
  - [04f88c8] 500 error returned when an Admin tries to delete membership of
    image from a non-existent /invalid tenant LP: 1060868
  - [5597697] Fragile Test:
    glance.tests.functional.test_bin_glance:TestBinGlance.test_update_copying_from
    LP: 1107768
  - [5183360] filesystem store does not clean up after premature termination
    of image upload LP: 1104924
  - [03dc862] mismatched image size or checksum leaves behind dangling image
    data LP: 1122299
  - [12d28c3] UserWarning on deprecation of legacy glance client inappropriate
    for internal usage LP: 1129445
  - [afe6166] 'glance-cache-manage list-cached' does not show 'last accessed'
    and 'last modified' fields in human-readable format' LP: 1102334
  - [ee13560] Fix broken JSON schemas in v2 tests

[ Chuck Short ]
* debian/patches/disable-swift-tests.patch: Refreshed.

64. By James Page on 2013-03-22

* Resync with latest security update.
* SECURITY UPDATE: fix information disclosure via Glance v1 API
  - debian/patches/CVE-2013-1840.patch: adjust api/middleware/cache.py to
    not show image_meta['location']
  - CVE-2013-1840

63. By Adam Gandelman on 2013-02-05

* Dropped patches, applied upstream:
  - debian/patches/CVE-2013-0212.patch: [96a470b]
* Resynchronize with stable/folsom (98d9928a) (LP: #1116671):
  - [96a470b] glance image-download can display backend Swift password
  - [4c96080] install throws errors about SADeprecationWarning LP: 925609
  - [bca6e26] wsgi.Middleware forward-compatibility with webob 1.2b1 or later
  - [5e5e722] Supplied image size should be verified against actual size
    LP: 1092584
  - [514b4b4] silent failure when loading the paste deploy app LP: 1091294

62. By Adam Gandelman on 2012-12-04

* Dropped patches, applied upstream:
  - debian/patches/CVE-2012-4573.patch
  - debian/patches/CVE-2012-4573b.patch
* Resynchronize with stable/folsom (199783ce) (LP: #1085255):
  - [49408e9] Glance image-delete HTTPInternalServerError HTTP 500
    (LP: #1075580)
  - [91aaa48] Image fails to upload to swift: TypeError: object of type
    'CooperativeReader' has no len( (LP: #1057322)
  - [a296a5b] Return 403 when admin deletes a deleted image (LP: #1060944)
  - [3e58a6a] Disallow updating deleted images. (LP: #1060930)
  - [26c8085] admins can see deleted images in v2 api (LP: #1071446)
  - [8321ca6] No exclude option to skip tests in run_tests.sh (LP: #1065758)
  - [c3bea11] Badly named stable/folsom Glance tarballs (LP: #1059634)
  - [fc0ee76] Non-admin users can cause public glance images to be deleted
    from the backend storage repository in the v2 api (LP: #1076506)
  - [90bcdc5] Non-admin users can cause public glance images to be deleted
    from the backend storage repository (LP: #1065187)
  - [7841cc9] FakeAuth not always admin
  - [ddad275] Jenkins jobs fail because of incompatibility between sqlalchemy-
    migrate and the newest sqlalchemy-0.8.0b1 (LP: #1073569)
  - [1d5c651] nosetest options cause no such option errors (LP: #1056420)
  - [ac223e2] Set defaultbranch in .gitreview to stable/folsom

61. By James Page on 2012-10-12

* Glance should suggest python-ceph, not ceph-common (LP: #1065903):
  - debian/control: glance Suggests: ceph-common -> python-ceph.

60. By Chuck Short on 2012-09-27

* debian/control: Clean-up python depends. Thanks to Sam Morrison.
  (LP: #1053790)
* New upstream release.

59. By Chuck Short on 2012-09-26

New usptream release.

58. By Chuck Short on 2012-09-26

* debian/control: Suggest ceph-common.
* debian/control: Add python-glanceclient as a build depends.
* New upstream release.
* debian/patches/disable-swift-tests.patch: Refreshed.

57. By Chuck Short on 2012-09-17

* New upstrem release.
* debian/glance.logrotate: compress right logfiles when rotating them.
  (LP: #1049314)

56. By Chuck Short on 2012-09-07

[ Chuck Short ]
* New upstream version.
* drop debian/patches/fix-docs-build.patch.
* debian/rules: Re-activate tests.
* debain/control: Add depends on python-swiftclient.
* debian/*.usptart: make glance start from runlevel 1 to runlevel
  2. (LP: #820688)

[ Soren Hansen ]
* Update debian/watch to account for symbolically named tarballs and
  use newer URL.
* New snapshot.
* Refresh disable-network-for-docs.patch
* Fix Launchpad URLs in debian/watch.