)]}'
{"gnocchi/rest/__init__.py":[{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"e520f07ad8bd967ae1c3c3dcd7dea713e687c009","unresolved":false,"context_lines":[{"line_number":269,"context_line":"    def get_one(self, id):"},{"line_number":270,"context_line":"        ap \u003d pecan.request.indexer.get_archive_policy(id)"},{"line_number":271,"context_line":"        if ap:"},{"line_number":272,"context_line":"            enforce(\"get archive policy\", ap)"},{"line_number":273,"context_line":"            return ArchivePolicyItem.archive_policy_to_human_readable(ap)"},{"line_number":274,"context_line":"        pecan.abort(404)"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a961159_447620a5","line":272,"updated":"2014-12-24 10:14:18.000000000","message":"IIUC moving the enforcement to within this if statement seems to open a tiny hole.\n\ni.e. a user/tenant without \u0027get archive policy\u0027 privileges can probe to see if a particular archive policy exists, by checking the status code of 404 versus 403\n\nBetter to simply to return 403 regardless of whether the archive policy exists in the case of enforce rejecting the call?","commit_id":"1477b10daffb23ae58d811b88c113e311aa70b78"},{"author":{"_account_id":1669,"name":"Julien Danjou","display_name":"jd","email":"julien@danjou.info","username":"jdanjou"},"change_message_id":"01a835ee93088bdf65c8213b01daa8ead1f3b9c3","unresolved":false,"context_lines":[{"line_number":269,"context_line":"    def get_one(self, id):"},{"line_number":270,"context_line":"        ap \u003d pecan.request.indexer.get_archive_policy(id)"},{"line_number":271,"context_line":"        if ap:"},{"line_number":272,"context_line":"            enforce(\"get archive policy\", ap)"},{"line_number":273,"context_line":"            return ArchivePolicyItem.archive_policy_to_human_readable(ap)"},{"line_number":274,"context_line":"        pecan.abort(404)"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a961159_a48168c5","line":272,"in_reply_to":"3a961159_447620a5","updated":"2014-12-26 09:52:08.000000000","message":"I find it odd to *always* return 200 or 403.\n\nI get the security concern but I\u0027m not really seeing what knowing that an UUID exists or not is really providing to a malicious user?\n\nOTOH returning 403 if an AP does not exist will make a lot of users wondering what they did wrong.","commit_id":"1477b10daffb23ae58d811b88c113e311aa70b78"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"c6e6554d8943d22f67fe800a8b27e5a67513fda6","unresolved":false,"context_lines":[{"line_number":269,"context_line":"    def get_one(self, id):"},{"line_number":270,"context_line":"        ap \u003d pecan.request.indexer.get_archive_policy(id)"},{"line_number":271,"context_line":"        if ap:"},{"line_number":272,"context_line":"            enforce(\"get archive policy\", ap)"},{"line_number":273,"context_line":"            return ArchivePolicyItem.archive_policy_to_human_readable(ap)"},{"line_number":274,"context_line":"        pecan.abort(404)"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a961159_0fb56531","line":272,"in_reply_to":"3a961159_a48168c5","updated":"2015-01-06 17:53:32.000000000","message":"I thought archive policies were identified in the API via descriptive names, e.g. high, low etc. as opposed to opaque UUIDs? as in the location header:\n\n  Location: http://localhost:8080/v1/archive_policy/low\n\nWould that give some tiny bit of useful info? i.e. an archive policy called implying a certain granularity was being persisted?\n\nMeh, in any case, probably not useful in any kind of realistic attack.","commit_id":"1477b10daffb23ae58d811b88c113e311aa70b78"}]}