)]}'
{"id":"openstack%2Fblazar~1006049","triplet_id":"openstack%2Fblazar~master~I7b33491e96440d419e3e5a514f1a7a46b82547f5","project":"openstack/blazar","branch":"master","topic":"bug/2162719","attention_set":{},"removed_from_attention_set":{"35263":{"account":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"last_update":"2026-09-21 07:18:14.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-93852","CVE-2026-93854","OSSA-2026-040"],"change_id":"I7b33491e96440d419e3e5a514f1a7a46b82547f5","subject":"Fix v2 API object-level authorization bypass","status":"MERGED","created":"2026-09-17 14:46:13.000000000","updated":"2026-09-21 07:20:03.000000000","submitted":"2026-09-21 07:18:14.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1006049-bug/2162719","meta_rev_id":"877b710450443da59749e4033d3abf222842589e","_number":1006049,"virtual_id_number":1006049,"owner":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-09-21 07:18:14.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},{"value":0,"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-09-21 06:43:22.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},{"value":2,"date":"2026-09-17 18:39:29.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-09-21 06:43:22.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},{"value":0,"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},{"value":0,"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Gate Blocker Fix / Urgent Change"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-17 14:50:20.000000000","updated_by":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"reviewer":{"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"},"state":"REVIEWER"},{"updated":"2026-09-17 14:50:20.000000000","updated_by":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"reviewer":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"state":"REVIEWER"},{"updated":"2026-09-17 15:35:02.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"8cbae60909c873881b81adf51beefd3894568773","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"date":"2026-09-17 14:46:13.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"1158e9c5b8740b5526f5d11b54757a3b57aacba7","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"date":"2026-09-17 14:46:35.000000000","message":"Uploaded patch set 2: Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"e18c8800a5d44df1360b8cb28fe35d597062ab30","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-17 15:35:02.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/e6d919a44af844909a038745894b7706\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7f24080968ed48d995b36b04b329b041 : FAILURE in 6m 32s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/170c586afdf04f68a8cb5f73357faa78 : SUCCESS in 3m 29s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/4f5b9767078344df894052fdfa431124 : FAILURE in 4m 32s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/caa22a32b6f64d738c91e5cb8ca2e30c : FAILURE in 4m 58s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/a03930976c83454e8d22d9b38ac74daf : FAILURE in 5m 43s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7e8657f1ff454f62bc7d411652ff30ae : SUCCESS in 9m 06s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cef384e760af44fa9462bea9c8157dda : SUCCESS in 4m 59s\n- blazar-tempest-plugin-base https://zuul.opendev.org/t/openstack/build/dff815a3daa047b29396fc409a09b379 : SUCCESS in 31m 53s\n- blazar-tempest-plugin-ipv6-only https://zuul.opendev.org/t/openstack/build/650d8c10d31d4e29ae3c3596b228a0eb : SUCCESS in 42m 28s\n- openstack-tox-pylint https://zuul.opendev.org/t/openstack/build/975682b5b38c4839b3a8b8fbbbdf7856 : FAILURE in 4m 27s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"cc26ed7a817b0fe73307156501bfd5731442f6e8","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-17 16:08:13.000000000","message":"Topic set to bug/2162719","accounts_in_message":[],"_revision_number":2},{"id":"f297a05f4cf02ae889b45c9844d75b21ca0e6c28","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"date":"2026-09-17 16:24:21.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"f838dea4e2e0b5c6d98858d4f446fb8b2a9b6c94","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"date":"2026-09-17 16:35:27.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"32855a2a99129a7cf5e6e8d152007eaa41897191","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-17 17:36:26.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8abd4e880bd048629c3005b86ba0774f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/a3a22c64da564c4191c48b6c5b809c34 : SUCCESS in 5m 39s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/248434c39455432eaf200e8975fb6152 : SUCCESS in 5m 12s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/0020cdbef4b748beb8b39a9ee130cb54 : SUCCESS in 4m 36s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/a3e6cbbd534a465fa310323ab1698233 : SUCCESS in 4m 30s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/eda66a546ba24f21a43bc3c77202371a : SUCCESS in 6m 50s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/76cd4a7280864632957740079ff804c4 : SUCCESS in 8m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/059d912fc84745779b32b4bf024b99d2 : SUCCESS in 4m 41s\n- blazar-tempest-plugin-base https://zuul.opendev.org/t/openstack/build/f5fb9250976d43efad76ce0b8f4c91bc : SUCCESS in 42m 16s\n- blazar-tempest-plugin-ipv6-only https://zuul.opendev.org/t/openstack/build/24ca2b8ad40a4a7b961ff0870d7d64ee : SUCCESS in 46m 12s\n- openstack-tox-pylint https://zuul.opendev.org/t/openstack/build/fb856798eab24f6191457811287fa0ff : FAILURE in 3m 54s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"e514b4cc9293c09dfd50706d3b0cbc6637971450","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-17 18:20:34.000000000","message":"Hashtag added: OSSA-2026-039","accounts_in_message":[],"_revision_number":4},{"id":"d32c2138fc4f8762cabc514d5081eed550901be3","author":{"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"},"date":"2026-09-17 18:39:29.000000000","message":"Patch Set 4: Code-Review+2","accounts_in_message":[],"_revision_number":4},{"id":"06efea3f5b47f460e74b6e36e1e640ce1fc2c6b5","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-18 21:28:19.000000000","message":"Hashtag added: OSSA-2026-040","accounts_in_message":[],"_revision_number":4},{"id":"8d15a39b07fd7a0bf493bad45960805b86a8e5aa","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-18 21:28:45.000000000","message":"Hashtag added: CVE-2026-93852","accounts_in_message":[],"_revision_number":4},{"id":"4809f793e8dd69807ae681d76f4c9dd6c7656913","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-18 21:28:51.000000000","message":"Hashtag added: CVE-2026-93854","accounts_in_message":[],"_revision_number":4},{"id":"31b6fee002a5f8cada83463ae373f3f166b57de5","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-18 21:29:18.000000000","message":"Hashtag removed: OSSA-2026-039","accounts_in_message":[],"_revision_number":4},{"id":"6a7bf459c417373a77e7ec7035d7568e35291c92","author":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"date":"2026-09-21 06:43:22.000000000","message":"Patch Set 4: Code-Review+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"037ab9251daed3a8f105481faebeba9193540614","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-21 06:43:58.000000000","message":"Patch Set 4: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":4},{"id":"677fa44cdc7d56f53b5d0413905165c254010123","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-21 07:18:14.000000000","message":"Patch Set 4: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/25f4956345d34dfa9ad5c5babb68bb9f\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d8a6b81af3004780b57b95b404eae8a3 : SUCCESS in 3m 37s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/497b55d3802b467fa9f8a8bdc75c1b03 : SUCCESS in 7m 14s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/e78a1071fc834337a4f8c85cba08dc73 : SUCCESS in 3m 07s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/70dea4551bcd4602988dd708feac5ea6 : SUCCESS in 5m 01s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/0604af20c9f1450aa414905ce0d1e428 : SUCCESS in 4m 32s\n- blazar-tempest-plugin-base https://zuul.opendev.org/t/openstack/build/d6f1412a79774a79acc850647cf9c120 : SUCCESS in 33m 01s\n- blazar-tempest-plugin-ipv6-only https://zuul.opendev.org/t/openstack/build/eb46ff3f48af4656810b99cb8b2b2e67 : SUCCESS in 25m 02s","accounts_in_message":[],"_revision_number":4},{"id":"0a8fd0a4e2238070d1789b6e492edc7cc64ea3cf","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-21 07:18:14.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":4},{"id":"877b710450443da59749e4033d3abf222842589e","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-21 07:20:03.000000000","message":"Patch Set 4:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b44eb569bc57454a80e3f27f8a7c5ca1\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/eeb81af2f1924e83954238cbd8793795 : SUCCESS in 1m 11s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/ddaa49e89e8e4e67a73cad7bc6876f3f : SUCCESS in 1m 20s","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"24cc74f93f413bdac287974dd2fdb107e9ee62bc","revisions":{"359a9e63a9576107d9c95ed697d9ce79c63593ec":{"kind":"REWORK","_number":1,"created":"2026-09-17 14:46:13.000000000","uploader":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"ref":"refs/changes/49/1006049/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/blazar","ref":"refs/changes/49/1006049/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/blazar refs/changes/49/1006049/1"}}},"commit":{"parents":[{"commit":"4afcd410015108d7740bece8ee2595e11d94e6e7","subject":"Merge \"Replace eventlet with threading in API\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/4afcd410015108d7740bece8ee2595e11d94e6e7"}]}],"author":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 13:12:11.000000000","tz":60},"committer":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 14:46:04.000000000","tz":60},"subject":"Fix v2 Object-level authorization bypass","message":"Fix v2 Object-level authorization bypass\n\nFixes two security flaws with the v2 API: any user could update/delete a\nlease from any project via the v2 API, provided that they had the lease ID.\nAdditionally, any user could use the v2 API to list all leases, including\nthose in another project.\n\nOperators that cannot yet upgrade should consider instead disabling the v2\nAPI with the following config in ``blazar.conf``:\n\n```\n[api]\napi_v2_controllers \u003d\n```\n\nCloses-Bug: #2162719\nChange-Id: I7b33491e96440d419e3e5a514f1a7a46b82547f5\nSigned-off-by: Matt Crees \u003cmattc@stackhpc.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/359a9e63a9576107d9c95ed697d9ce79c63593ec"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/359a9e63a9576107d9c95ed697d9ce79c63593ec"}]},"branch":"refs/heads/master"},"a6411c6a037e6baa1dd279ed71ee5c89d71b7e48":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2026-09-17 14:46:35.000000000","uploader":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"ref":"refs/changes/49/1006049/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/blazar","ref":"refs/changes/49/1006049/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/blazar refs/changes/49/1006049/2"}}},"commit":{"parents":[{"commit":"4afcd410015108d7740bece8ee2595e11d94e6e7","subject":"Merge \"Replace eventlet with threading in API\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/4afcd410015108d7740bece8ee2595e11d94e6e7"}]}],"author":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 13:12:11.000000000","tz":60},"committer":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 14:46:24.000000000","tz":60},"subject":"Fix v2 API object-level authorization bypass","message":"Fix v2 API object-level authorization bypass\n\nFixes two security flaws with the v2 API: any user could update/delete a\nlease from any project via the v2 API, provided that they had the lease ID.\nAdditionally, any user could use the v2 API to list all leases, including\nthose in another project.\n\nOperators that cannot yet upgrade should consider instead disabling the v2\nAPI with the following config in ``blazar.conf``:\n\n```\n[api]\napi_v2_controllers \u003d\n```\n\nCloses-Bug: #2162719\nChange-Id: I7b33491e96440d419e3e5a514f1a7a46b82547f5\nSigned-off-by: Matt Crees \u003cmattc@stackhpc.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/a6411c6a037e6baa1dd279ed71ee5c89d71b7e48"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/a6411c6a037e6baa1dd279ed71ee5c89d71b7e48"}]},"branch":"refs/heads/master"},"6400374660a85d9ab6f1dd51668c6aec1fec7756":{"kind":"REWORK","_number":3,"created":"2026-09-17 16:24:21.000000000","uploader":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"ref":"refs/changes/49/1006049/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/blazar","ref":"refs/changes/49/1006049/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/blazar refs/changes/49/1006049/3"}}},"commit":{"parents":[{"commit":"4afcd410015108d7740bece8ee2595e11d94e6e7","subject":"Merge \"Replace eventlet with threading in API\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/4afcd410015108d7740bece8ee2595e11d94e6e7"}]}],"author":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 13:12:11.000000000","tz":60},"committer":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 16:24:14.000000000","tz":60},"subject":"Fix v2 API object-level authorization bypass","message":"Fix v2 API object-level authorization bypass\n\nFixes two security flaws with the v2 API: any user could update/delete a\nlease from any project via the v2 API, provided that they had the lease ID.\nAdditionally, any user could use the v2 API to list all leases, including\nthose in another project.\n\nOperators that cannot yet upgrade should consider instead disabling the v2\nAPI with the following config in ``blazar.conf``:\n\n```\n[api]\napi_v2_controllers \u003d\n```\n\nCloses-Bug: #2162719\nChange-Id: I7b33491e96440d419e3e5a514f1a7a46b82547f5\nSigned-off-by: Matt Crees \u003cmattc@stackhpc.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/6400374660a85d9ab6f1dd51668c6aec1fec7756"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/6400374660a85d9ab6f1dd51668c6aec1fec7756"}]},"branch":"refs/heads/master"},"24cc74f93f413bdac287974dd2fdb107e9ee62bc":{"kind":"REWORK","_number":4,"created":"2026-09-17 16:35:27.000000000","uploader":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"ref":"refs/changes/49/1006049/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/blazar","ref":"refs/changes/49/1006049/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/blazar refs/changes/49/1006049/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/blazar refs/changes/49/1006049/4"}}},"commit":{"parents":[{"commit":"4afcd410015108d7740bece8ee2595e11d94e6e7","subject":"Merge \"Replace eventlet with threading in API\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/4afcd410015108d7740bece8ee2595e11d94e6e7"}]}],"author":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 13:12:11.000000000","tz":60},"committer":{"name":"Matt Crees","email":"mattc@stackhpc.com","date":"2026-09-17 16:35:21.000000000","tz":60},"subject":"Fix v2 API object-level authorization bypass","message":"Fix v2 API object-level authorization bypass\n\nFixes two security flaws with the v2 API: any user could update/delete a\nlease from any project via the v2 API, provided that they had the lease ID.\nAdditionally, any user could use the v2 API to list all leases, including\nthose in another project.\n\nOperators that cannot yet upgrade should consider instead disabling the v2\nAPI with the following config in ``blazar.conf``:\n\n```\n[api]\napi_v2_controllers \u003d\n```\n\nCloses-Bug: #2162719\nChange-Id: I7b33491e96440d419e3e5a514f1a7a46b82547f5\nSigned-off-by: Matt Crees \u003cmattc@stackhpc.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/24cc74f93f413bdac287974dd2fdb107e9ee62bc"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/blazar/commit/24cc74f93f413bdac287974dd2fdb107e9ee62bc"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":33582,"name":"Mark Powers","email":"markpowers@uchicago.edu","username":"markpowers"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"}},{"label":"Review-Priority","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Review-Priority","description":"Review priority","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"-label:Review-Priority\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":[],"failing_atoms":["label:Review-Priority\u003dMIN"],"atom_explanations":{"label:Review-Priority\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}