)]}'
{"id":"openstack%2Fglance~145916","triplet_id":"openstack%2Fglance~stable%2Fjuno~I02cd099a8634b9c7e3cf8f172bcbd33f8edcbc83","project":"openstack/glance","branch":"stable/juno","topic":"bug/1408663","hashtags":[],"change_id":"I02cd099a8634b9c7e3cf8f172bcbd33f8edcbc83","subject":"Prevent file, swift+config and filesystem schemes","status":"MERGED","created":"2015-01-08 19:51:45.000000000","updated":"2015-01-21 19:18:26.000000000","submitted":"2015-01-12 11:34:54.000000000","submitter":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"0cea4ff04154fd6a229f0560c26e00086a12c796","_number":145916,"virtual_id_number":145916,"owner":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"all":[{"value":0,"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},{"value":0,"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},{"value":2,"date":"2015-01-12 11:34:54.000000000","_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},{"value":0,"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},{"value":0,"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},{"value":0,"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"recommended":{"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},"all":[{"value":1,"date":"2015-01-09 16:06:04.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},{"value":1,"date":"2015-01-09 00:16:00.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},{"value":0,"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":1,"date":"2015-01-12 00:06:02.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},{"value":1,"date":"2015-01-08 22:59:05.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},{"value":2,"date":"2015-01-09 15:08:52.000000000","_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},{"value":0,"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"all":[{"value":0,"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},{"value":0,"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},{"value":0,"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},{"value":0,"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},{"value":1,"date":"2015-01-12 10:18:29.000000000","_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},{"value":0,"date":"2015-01-21 09:49:28.000000000","post_submit":true,"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},{"value":0,"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},{"value":0,"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},{"value":0,"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},{"value":0,"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},{"value":0,"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Top Priority / Holds Gate"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},{"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},{"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"},{"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2015-01-08 22:59:05.000000000","updated_by":{"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},"reviewer":{"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},"state":"REVIEWER"},{"updated":"2015-01-09 00:16:00.000000000","updated_by":{"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},"reviewer":{"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},"state":"REVIEWER"},{"updated":"2015-01-09 16:06:04.000000000","updated_by":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"reviewer":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"state":"REVIEWER"},{"updated":"2015-01-12 00:06:02.000000000","updated_by":{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},"reviewer":{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},"state":"REVIEWER"},{"updated":"2015-01-12 10:18:29.000000000","updated_by":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"reviewer":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"state":"REVIEWER"},{"updated":"2015-01-12 11:34:54.000000000","updated_by":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"reviewer":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"state":"REVIEWER"},{"updated":"2015-01-21 09:49:28.000000000","updated_by":{"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"},"reviewer":{"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"},"state":"REVIEWER"}],"messages":[{"id":"ddfb7c296609960bb654c6751a57c5e2d38187e7","author":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"date":"2015-01-08 19:51:45.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"71ae0486bd4cea3c508ede9d3b9c0edb2b3b11fe","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-01-08 21:51:30.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- gate-glance-python26 http://logs.openstack.org/16/145916/1/check/gate-glance-python26/992c873/ : SUCCESS in 21m 44s\n- gate-glance-pep8 http://logs.openstack.org/16/145916/1/check/gate-glance-pep8/010aa20/ : SUCCESS in 2m 35s\n- gate-glance-docs http://docs-draft.openstack.org/16/145916/1/check/gate-glance-docs/3d10a01//doc/build/html/ : SUCCESS in 1m 49s\n- gate-glance-python27 http://logs.openstack.org/16/145916/1/check/gate-glance-python27/ba9bee9/ : SUCCESS in 17m 18s\n- check-tempest-dsvm-full http://logs.openstack.org/16/145916/1/check/check-tempest-dsvm-full/b5a2213/ : SUCCESS in 51m 35s\n- check-tempest-dsvm-postgres-full http://logs.openstack.org/16/145916/1/check/check-tempest-dsvm-postgres-full/85b2299/ : SUCCESS in 41m 28s\n- check-tempest-dsvm-neutron http://logs.openstack.org/16/145916/1/check/check-tempest-dsvm-neutron/721939e/ : SUCCESS in 44m 43s\n- check-tempest-dsvm-neutron-full http://logs.openstack.org/16/145916/1/check/check-tempest-dsvm-neutron-full/117b5a1/ : SUCCESS in 36m 47s\n- check-grenade-dsvm http://logs.openstack.org/16/145916/1/check/check-grenade-dsvm/31c47d6/ : SUCCESS in 33m 37s\n- gate-tempest-dsvm-large-ops http://logs.openstack.org/16/145916/1/check/gate-tempest-dsvm-large-ops/ba9e0c9/ : SUCCESS in 22m 32s\n- gate-tempest-dsvm-neutron-large-ops http://logs.openstack.org/16/145916/1/check/gate-tempest-dsvm-neutron-large-ops/da8ea97/ : SUCCESS in 20m 54s\n- check-devstack-dsvm-cells http://logs.openstack.org/16/145916/1/check/check-devstack-dsvm-cells/7fe2e9e/ : SUCCESS in 18m 18s\n- gate-rally-dsvm-glance http://logs.openstack.org/16/145916/1/check/gate-rally-dsvm-glance/bda0c82/ : SUCCESS in 26m 05s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"b11fa56712863e6d9c5035f82d5b34bcd70563d9","author":{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},"date":"2015-01-08 22:14:39.000000000","message":"Patch Set 1: Code-Review-1\n\nThe fix should be cherrypicked from https://review.openstack.org/145640","accounts_in_message":[],"_revision_number":1},{"id":"0851aff997c875eec6d511aec7d0692b0ede653b","author":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"date":"2015-01-08 22:44:13.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"d2027385c95e69e8bd35855a6895101b574022f0","author":{"_account_id":6589,"name":"Jesse Keating","email":"jkeating@j2solutions.net","username":"jesse-keating"},"date":"2015-01-08 22:59:05.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"8e49f98eae32d0065b7b8b5e554f6e27d6cf5f36","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-01-08 23:40:36.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\n\n- gate-glance-python26 http://logs.openstack.org/16/145916/2/check/gate-glance-python26/1d88e96/ : SUCCESS in 21m 26s\n- gate-glance-pep8 http://logs.openstack.org/16/145916/2/check/gate-glance-pep8/28122d2/ : SUCCESS in 2m 21s\n- gate-glance-docs http://docs-draft.openstack.org/16/145916/2/check/gate-glance-docs/2b030ca//doc/build/html/ : SUCCESS in 1m 58s\n- gate-glance-python27 http://logs.openstack.org/16/145916/2/check/gate-glance-python27/35f200e/ : SUCCESS in 16m 59s\n- check-tempest-dsvm-full http://logs.openstack.org/16/145916/2/check/check-tempest-dsvm-full/c0c506d/ : SUCCESS in 33m 51s\n- check-tempest-dsvm-postgres-full http://logs.openstack.org/16/145916/2/check/check-tempest-dsvm-postgres-full/533e8f2/ : SUCCESS in 38m 21s\n- check-tempest-dsvm-neutron http://logs.openstack.org/16/145916/2/check/check-tempest-dsvm-neutron/7409611/ : SUCCESS in 45m 51s\n- check-tempest-dsvm-neutron-full http://logs.openstack.org/16/145916/2/check/check-tempest-dsvm-neutron-full/833fbb3/ : SUCCESS in 49m 32s\n- check-grenade-dsvm http://logs.openstack.org/16/145916/2/check/check-grenade-dsvm/14f7335/ : SUCCESS in 34m 26s\n- gate-tempest-dsvm-large-ops http://logs.openstack.org/16/145916/2/check/gate-tempest-dsvm-large-ops/516cce3/ : SUCCESS in 29m 18s\n- gate-tempest-dsvm-neutron-large-ops http://logs.openstack.org/16/145916/2/check/gate-tempest-dsvm-neutron-large-ops/852af1a/ : SUCCESS in 26m 08s\n- check-devstack-dsvm-cells http://logs.openstack.org/16/145916/2/check/check-devstack-dsvm-cells/976debd/ : SUCCESS in 18m 45s\n- gate-rally-dsvm-glance http://logs.openstack.org/16/145916/2/check/gate-rally-dsvm-glance/07a5959/ : SUCCESS in 26m 27s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"5a06de63b3891da9765cbb0cbcc2b4b891382aec","author":{"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},"date":"2015-01-09 00:16:00.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"228a722c62ac23bd354489a59277069f7f33366e","author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"date":"2015-01-09 15:08:52.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"03237b22b782a1b89dc177b9b435fcc1dab8f6a2","author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"date":"2015-01-09 16:06:04.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"7c949a645709a278e005cc64952a42f757770352","author":{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},"date":"2015-01-12 00:06:02.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"68cc8993726cd7ed0d2829a6f5fd7da036c49fdc","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-01-12 10:18:29.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.\nhttp://status.openstack.org/zuul/","accounts_in_message":[],"_revision_number":2},{"id":"f37dfc1e23b53491ca27fdd111d9d53bef726b49","author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"date":"2015-01-12 10:18:29.000000000","message":"Patch Set 2: Workflow+1\n\nMaster patch landed, moving the CVE fix forward.","accounts_in_message":[],"_revision_number":2},{"id":"529b58cd26335e2f62f40fde2e3cce13a02a46e0","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-01-12 11:34:54.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- gate-glance-python26 http://logs.openstack.org/16/145916/2/gate/gate-glance-python26/068f06b/ : SUCCESS in 20m 57s\n- gate-glance-docs http://docs-draft.openstack.org/16/145916/2/gate/gate-glance-docs/aa0cf59//doc/build/html/ : SUCCESS in 1m 46s\n- gate-glance-pep8 http://logs.openstack.org/16/145916/2/gate/gate-glance-pep8/514cf32/ : SUCCESS in 2m 22s\n- gate-glance-python27 http://logs.openstack.org/16/145916/2/gate/gate-glance-python27/65dfa12/ : SUCCESS in 17m 47s\n- gate-tempest-dsvm-full http://logs.openstack.org/16/145916/2/gate/gate-tempest-dsvm-full/4bdf885/ : SUCCESS in 42m 09s\n- gate-tempest-dsvm-postgres-full http://logs.openstack.org/16/145916/2/gate/gate-tempest-dsvm-postgres-full/b9402ca/ : SUCCESS in 33m 36s\n- gate-tempest-dsvm-neutron http://logs.openstack.org/16/145916/2/gate/gate-tempest-dsvm-neutron/83a636d/ : SUCCESS in 41m 49s\n- gate-tempest-dsvm-neutron-full http://logs.openstack.org/16/145916/2/gate/gate-tempest-dsvm-neutron-full/537c560/ : SUCCESS in 46m 07s\n- gate-grenade-dsvm http://logs.openstack.org/16/145916/2/gate/gate-grenade-dsvm/774221b/ : SUCCESS in 28m 19s\n- gate-tempest-dsvm-large-ops http://logs.openstack.org/16/145916/2/gate/gate-tempest-dsvm-large-ops/ab0ba6c/ : SUCCESS in 23m 38s\n- gate-tempest-dsvm-neutron-large-ops http://logs.openstack.org/16/145916/2/gate/gate-tempest-dsvm-neutron-large-ops/229a5a9/ : SUCCESS in 19m 37s\n- gate-devstack-dsvm-cells http://logs.openstack.org/16/145916/2/gate/gate-devstack-dsvm-cells/abc9cf4/ : SUCCESS in 17m 56s","accounts_in_message":[],"_revision_number":2},{"id":"094fa0584075c36573e1a50294d61f7dc6ba2814","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-01-12 11:34:55.000000000","message":"Change has been successfully merged into the git repository.","accounts_in_message":[],"_revision_number":2},{"id":"3fbee552fdefa03fce49b0ea17c1babf157d3be1","author":{"_account_id":7487,"name":"hzrandd","email":"82433422@qq.com","username":"hzrandd"},"date":"2015-01-21 09:57:18.000000000","message":"Patch Set 2:\n\nHello, should add a configuration item to control ?","accounts_in_message":[],"_revision_number":2},{"id":"ecf8a815cf71154a72ed5b4d6bc1cb356b51c85f","author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"date":"2015-01-21 19:18:26.000000000","message":"Patch Set 2:\n\nNo. I don\u0027t think we should be allowing users to expose themselves to vulnerabilities.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"5191ed1879c5fd5b2694f922bcedec232f461088","revisions":{"a90355632abafc4fe07d82b327d23ac433628cc7":{"kind":"REWORK","_number":1,"created":"2015-01-08 19:51:45.000000000","uploader":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"ref":"refs/changes/16/145916/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/glance","ref":"refs/changes/16/145916/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/glance refs/changes/16/145916/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/glance refs/changes/16/145916/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/glance refs/changes/16/145916/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/glance refs/changes/16/145916/1"}}},"commit":{"parents":[{"commit":"42564be7ea133313a52639c27172d035390da1f2","subject":"Merge \"To prevent client use v2 patch api to handle file and swift location\" into stable/juno","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/42564be7ea133313a52639c27172d035390da1f2"}]}],"author":{"name":"Grant Murphy","email":"grant.murphy@hp.com","date":"2015-01-08 00:09:38.000000000","tz":-480},"committer":{"name":"Grant Murphy","email":"grant.murphy@hp.com","date":"2015-01-08 19:51:25.000000000","tz":0},"subject":"Prevent file, swift+config and filesystem schemes","message":"Prevent file, swift+config and filesystem schemes\n\nThis change ensures that \u0027file\u0027, \u0027filesystem\u0027, and \u0027swift+config\u0027 URI\nschemes are not allowed when setting the location field. A previous\nfix to CVE-2014-9493 attempted to address this issue but did not\ninclude \u0027filesystem\u0027, a URI scheme allowed by the glance_store.\n\nWithout this fix in place it is possible for a client to access any file\nthe glance-api server has read permissions for.\n\nChange-Id: I02cd099a8634b9c7e3cf8f172bcbd33f8edcbc83\nCloses-Bug: #1408663\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/a90355632abafc4fe07d82b327d23ac433628cc7"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/a90355632abafc4fe07d82b327d23ac433628cc7"}]},"branch":"refs/heads/stable/juno"},"5191ed1879c5fd5b2694f922bcedec232f461088":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2015-01-08 22:44:13.000000000","uploader":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"ref":"refs/changes/16/145916/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/glance","ref":"refs/changes/16/145916/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/glance refs/changes/16/145916/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/glance refs/changes/16/145916/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/glance refs/changes/16/145916/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/glance refs/changes/16/145916/2"}}},"commit":{"parents":[{"commit":"42564be7ea133313a52639c27172d035390da1f2","subject":"Merge \"To prevent client use v2 patch api to handle file and swift location\" into stable/juno","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/42564be7ea133313a52639c27172d035390da1f2"}]}],"author":{"name":"Grant Murphy","email":"grant.murphy@hp.com","date":"2015-01-08 00:09:38.000000000","tz":-480},"committer":{"name":"Grant Murphy","email":"grant.murphy@hp.com","date":"2015-01-08 22:43:54.000000000","tz":-480},"subject":"Prevent file, swift+config and filesystem schemes","message":"Prevent file, swift+config and filesystem schemes\n\nThis change ensures that \u0027file\u0027, \u0027filesystem\u0027, and \u0027swift+config\u0027 URI\nschemes are not allowed when setting the location field. A previous\nfix to CVE-2014-9493 attempted to address this issue but did not\ninclude \u0027filesystem\u0027, a URI scheme allowed by the glance_store.\n\nWithout this fix in place it is possible for a client to access any file\nthe glance-api server has read permissions for.\n\nChange-Id: I02cd099a8634b9c7e3cf8f172bcbd33f8edcbc83\nCloses-Bug: #1408663\n(cherry picked from commit a2d986b976e9325a272e2d422465165315d19fe6)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/5191ed1879c5fd5b2694f922bcedec232f461088"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/5191ed1879c5fd5b2694f922bcedec232f461088"}]},"branch":"refs/heads/stable/juno"}},"requirements":[],"submit_records":[],"submit_requirements":[]}