)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"c3abbfe382e2895f5a710d3d3ec1017a65e28c78","unresolved":false,"context_lines":[{"line_number":16,"context_line":"This change is the first step to grouping all X-Auth-Url related logic"},{"line_number":17,"context_line":"into one single middleware as opposed to have it scattered (or possibly"},{"line_number":18,"context_line":"repeated) in auth_token and auth_password. For example, auth_password"},{"line_number":19,"context_line":"also has some logic around it related to multi-cloud.  When auth_token"},{"line_number":20,"context_line":"is updated to support multi-cloud, this logic can be extracted into the"},{"line_number":21,"context_line":"auth_url middleware rather than duplicating it across both the"},{"line_number":22,"context_line":"auth_token and auth_password middleware."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"AAAAUH%2F%2FTL4%3D","line":19,"updated":"2014-01-15 10:45:44.000000000","message":"I think you mean s/auth_token/auth_url here, and I\u0027m not sure what you\u0027re saying needs to be updated for multi-cloud?\n\nDo you really mean: \n\n\"auth_password\talso has some logic around X-Auth-Url related to multi-cloud, which can be extracted into the auth_url middleware, so all handling of X-Auth-Url occurs in one place\" ?\n\nI\u0027d be +1 on just pulling the logic out of auth_password now, or in a subsequent patch if you prefer.","commit_id":"aced5485a1bf28d72b984ba2f519f512d93bec7c"},{"author":{"_account_id":9189,"name":"Anderson Mesquita","email":"andersonvom@gmail.com","username":"andersonvom"},"change_message_id":"aa3ce842d942722fd25d17bd186aa01cb93278dd","unresolved":false,"context_lines":[{"line_number":16,"context_line":"This change is the first step to grouping all X-Auth-Url related logic"},{"line_number":17,"context_line":"into one single middleware as opposed to have it scattered (or possibly"},{"line_number":18,"context_line":"repeated) in auth_token and auth_password. For example, auth_password"},{"line_number":19,"context_line":"also has some logic around it related to multi-cloud.  When auth_token"},{"line_number":20,"context_line":"is updated to support multi-cloud, this logic can be extracted into the"},{"line_number":21,"context_line":"auth_url middleware rather than duplicating it across both the"},{"line_number":22,"context_line":"auth_token and auth_password middleware."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"AAAAUH%2F%2FR94%3D","line":19,"in_reply_to":"AAAAUH%2F%2FTL4%3D","updated":"2014-01-15 17:27:39.000000000","message":"That is precisely what I meant, I guess I can reword it like that.  \n\nI also thought about sending the extracted logic in a later patch. Though, talking to @stevebaker yesterday on IRC, he told me to talk to @bgorsky first to see if it would matter to multi-region.  I\u0027ll probably submit the patch anyway and notify @bgorsky.","commit_id":"aced5485a1bf28d72b984ba2f519f512d93bec7c"}],"etc/heat/api-paste.ini":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"5fe7e6df027374bb710b91c744ea62764cdcc0a0","unresolved":false,"context_lines":[{"line_number":1,"context_line":""},{"line_number":2,"context_line":"# heat-api pipeline"},{"line_number":3,"context_line":"[pipeline:heat-api]"},{"line_number":4,"context_line":"pipeline \u003d faultwrap versionnegotiation authurl authtoken context apiv1app"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"# heat-api pipeline for standalone heat"},{"line_number":7,"context_line":"# ie. uses alternative auth backend that authenticates users against keystone"}],"source_content_type":"text/x-properties","patch_set":11,"id":"AAAAUH%2F%2B9fk%3D","line":4,"updated":"2014-01-20 11:40:44.000000000","message":"The authurl and authtoken order should be reversed here, if you want the behavior to be exactly as it was before.","commit_id":"437e6cd1465056134ad5ee23a5bfca7f71004299"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"0e82577a55422ca59db77b892afce114b6c8aadf","unresolved":false,"context_lines":[{"line_number":1,"context_line":""},{"line_number":2,"context_line":"# heat-api pipeline"},{"line_number":3,"context_line":"[pipeline:heat-api]"},{"line_number":4,"context_line":"pipeline \u003d faultwrap versionnegotiation authurl authtoken context apiv1app"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"# heat-api pipeline for standalone heat"},{"line_number":7,"context_line":"# ie. uses alternative auth backend that authenticates users against keystone"}],"source_content_type":"text/x-properties","patch_set":11,"id":"AAAAUH%2F%2BjVk%3D","line":4,"in_reply_to":"AAAAUH%2F%2B1M4%3D","updated":"2014-01-24 13:23:40.000000000","message":"OK sounds reasonable :)","commit_id":"437e6cd1465056134ad5ee23a5bfca7f71004299"},{"author":{"_account_id":9189,"name":"Anderson Mesquita","email":"andersonvom@gmail.com","username":"andersonvom"},"change_message_id":"7bd1a4f2f879ffc47b308630211b43b9b88202b1","unresolved":false,"context_lines":[{"line_number":1,"context_line":""},{"line_number":2,"context_line":"# heat-api pipeline"},{"line_number":3,"context_line":"[pipeline:heat-api]"},{"line_number":4,"context_line":"pipeline \u003d faultwrap versionnegotiation authurl authtoken context apiv1app"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"# heat-api pipeline for standalone heat"},{"line_number":7,"context_line":"# ie. uses alternative auth backend that authenticates users against keystone"}],"source_content_type":"text/x-properties","patch_set":11,"id":"AAAAUH%2F%2B1M4%3D","line":4,"in_reply_to":"AAAAUH%2F%2B9fk%3D","updated":"2014-01-21 16:40:11.000000000","message":"I guess I could change and swap these, but authpassword relies on the fact that X-Auth-Url is already set, and since we\u0027re going to extract that logic into authurl, it will have to go back to the front of the pipeline again.  So, IMO, given it doesn\u0027t impact the change in any way, it should probably just stay like this.\n\nWhat do you think?","commit_id":"437e6cd1465056134ad5ee23a5bfca7f71004299"}],"heat/common/auth_url.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"c3abbfe382e2895f5a710d3d3ec1017a65e28c78","unresolved":false,"context_lines":[{"line_number":33,"context_line":"            # Import auth_token to have keystone_authtoken settings setup."},{"line_number":34,"context_line":"            auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"},{"line_number":35,"context_line":"            importutils.import_module(auth_token_module)"},{"line_number":36,"context_line":"            return cfg.CONF.keystone_authtoken.auth_uri"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    def process_request(self, req):"},{"line_number":39,"context_line":"        req.headers[\u0027X-Auth-Url\u0027] \u003d self.auth_url"}],"source_content_type":"text/x-python","patch_set":10,"id":"AAAAUH%2F%2FTGg%3D","line":36,"updated":"2014-01-15 10:45:44.000000000","message":"heat/api/aws/ec2token.py does exactly the same as this, so we could consider a common base class to avoid duplication?","commit_id":"aced5485a1bf28d72b984ba2f519f512d93bec7c"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"68412732123e2fdcbdf6a8e4bfe3bce6f3a5c058","unresolved":false,"context_lines":[{"line_number":33,"context_line":"            # Import auth_token to have keystone_authtoken settings setup."},{"line_number":34,"context_line":"            auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"},{"line_number":35,"context_line":"            importutils.import_module(auth_token_module)"},{"line_number":36,"context_line":"            return cfg.CONF.keystone_authtoken.auth_uri"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    def process_request(self, req):"},{"line_number":39,"context_line":"        req.headers[\u0027X-Auth-Url\u0027] \u003d self.auth_url"}],"source_content_type":"text/x-python","patch_set":10,"id":"AAAAUH%2F%2B9hg%3D","line":36,"in_reply_to":"AAAAUH%2F%2FRDA%3D","updated":"2014-01-20 11:35:04.000000000","message":"Yeah, ideally you\u0027d have a refactor patch making a base-class available, then make this change depend on that patch and use the base class.\n\nAn alternative (less preferable) approach is to merge anyway with the duplication issue not addressed and fix it later, but then the refactoring sometimes never happens ;)","commit_id":"aced5485a1bf28d72b984ba2f519f512d93bec7c"},{"author":{"_account_id":9189,"name":"Anderson Mesquita","email":"andersonvom@gmail.com","username":"andersonvom"},"change_message_id":"aa3ce842d942722fd25d17bd186aa01cb93278dd","unresolved":false,"context_lines":[{"line_number":33,"context_line":"            # Import auth_token to have keystone_authtoken settings setup."},{"line_number":34,"context_line":"            auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"},{"line_number":35,"context_line":"            importutils.import_module(auth_token_module)"},{"line_number":36,"context_line":"            return cfg.CONF.keystone_authtoken.auth_uri"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    def process_request(self, req):"},{"line_number":39,"context_line":"        req.headers[\u0027X-Auth-Url\u0027] \u003d self.auth_url"}],"source_content_type":"text/x-python","patch_set":10,"id":"AAAAUH%2F%2FRDA%3D","line":36,"in_reply_to":"AAAAUH%2F%2FTGg%3D","updated":"2014-01-15 17:27:39.000000000","message":"This should probably be handled in a different patch, since it\u0027s mostly refactoring, right?","commit_id":"aced5485a1bf28d72b984ba2f519f512d93bec7c"}],"heat/common/context.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"14409731bb2110e340dc251808a99d49221575f9","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"            # Import auth_token to have keystone_authtoken settings setup."},{"line_number":152,"context_line":"            importutils.import_module(\u0027keystoneclient.middleware.auth_token\u0027)"},{"line_number":153,"context_line":"            auth_url \u003d cfg.CONF.keystone_authtoken.auth_uri"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"        except Exception:"},{"line_number":156,"context_line":"            raise exception.NotAuthenticated()"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATn%2F9jGw%3D","line":153,"updated":"2013-12-10 11:12:48.000000000","message":"So this looks OK, but I\u0027m interested to discuss the pros and cons of doing this here in the context, vs just importing the config directly in the engine (e.g in heat_keystoneclient, which is our abstraction for all interaction with keystone inside the engine)\n\nMy feeling is that we should just read the config directly inside the engine, as here we\u0027re reading heat.conf in the heat-api process, then passing the value to the engine where it is used.  \n\nThis will be fine in many circumstances, but I\u0027m just wondering if it makes sense in deployments where heat-api and heat-engine are running on different machines, potentially with different configs?","commit_id":"a50ed300cbb292da4c3219301268502afb79236c"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"944c755522bc387ea3c90dd76959b02516c6d260","unresolved":false,"context_lines":[{"line_number":149,"context_line":"            if roles is not None:"},{"line_number":150,"context_line":"                roles \u003d roles.split(\u0027,\u0027)"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"            auth_url \u003d headers.get(\u0027X-Auth-Url\u0027)"},{"line_number":153,"context_line":"            if not auth_url:"},{"line_number":154,"context_line":"                # Import auth_token to have keystone_authtoken settings setup."},{"line_number":155,"context_line":"                auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FY2o%3D","line":152,"updated":"2014-01-14 10:21:21.000000000","message":"Thinking about this (and having done a quick test), I think this is unsafe - it means that any user can override the stored keystone URL with whatever they provide (even in the non multi-cloud case).\n\nSurely that will mean they can authenticate with keystone, then point heat at some other keystone (perhaps one which they control) and spoof our client connections into  being made with potentially elevated privileges since we\u0027re not necessarily pointing to the configured keystone URL anymore?","commit_id":"d399a0f0b745385de1b1aef4ed9258be9b8110ac"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"dc457914644cebf25598d3e78257301ebb89a61d","unresolved":false,"context_lines":[{"line_number":149,"context_line":"            if roles is not None:"},{"line_number":150,"context_line":"                roles \u003d roles.split(\u0027,\u0027)"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"            auth_url \u003d headers.get(\u0027X-Auth-Url\u0027)"},{"line_number":153,"context_line":"            if not auth_url:"},{"line_number":154,"context_line":"                # Import auth_token to have keystone_authtoken settings setup."},{"line_number":155,"context_line":"                auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FTMY%3D","line":152,"in_reply_to":"AAAAUH%2F%2FWe4%3D","updated":"2014-01-15 10:20:29.000000000","message":"Yeah multi-cloud is the only time we should ever accept that header, when it is validated, for all other cases we should just store what\u0027s in the config.","commit_id":"d399a0f0b745385de1b1aef4ed9258be9b8110ac"},{"author":{"_account_id":9189,"name":"Anderson Mesquita","email":"andersonvom@gmail.com","username":"andersonvom"},"change_message_id":"a5c0d11d1461a37e76f489efe253f5937b36418a","unresolved":false,"context_lines":[{"line_number":149,"context_line":"            if roles is not None:"},{"line_number":150,"context_line":"                roles \u003d roles.split(\u0027,\u0027)"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"            auth_url \u003d headers.get(\u0027X-Auth-Url\u0027)"},{"line_number":153,"context_line":"            if not auth_url:"},{"line_number":154,"context_line":"                # Import auth_token to have keystone_authtoken settings setup."},{"line_number":155,"context_line":"                auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FWe4%3D","line":152,"in_reply_to":"AAAAUH%2F%2FXDM%3D","updated":"2014-01-14 18:44:53.000000000","message":"So if you look at auth_password.py, it actually validates the URL passed in the headers when multi-cloud is ON, which makes sense and still allows it to be passed on the headers.","commit_id":"d399a0f0b745385de1b1aef4ed9258be9b8110ac"},{"author":{"_account_id":7256,"name":"Randall Burt","email":"randall.burt@rackspace.com","username":"randall-burt"},"change_message_id":"c55ff4f380d24b54023ae7a33bde305883ed0f4c","unresolved":false,"context_lines":[{"line_number":149,"context_line":"            if roles is not None:"},{"line_number":150,"context_line":"                roles \u003d roles.split(\u0027,\u0027)"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"            auth_url \u003d headers.get(\u0027X-Auth-Url\u0027)"},{"line_number":153,"context_line":"            if not auth_url:"},{"line_number":154,"context_line":"                # Import auth_token to have keystone_authtoken settings setup."},{"line_number":155,"context_line":"                auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FXDM%3D","line":152,"in_reply_to":"AAAAUH%2F%2FXbM%3D","updated":"2014-01-14 17:01:37.000000000","message":"Can\u0027t we simply ignore all X-Auth-Url headers and always store what\u0027s configured in the context? We should never accept X-Auth-Url from an http header, but I thought this was originally changed to use it because someone was concerned about multi-cloud implications.","commit_id":"d399a0f0b745385de1b1aef4ed9258be9b8110ac"},{"author":{"_account_id":9189,"name":"Anderson Mesquita","email":"andersonvom@gmail.com","username":"andersonvom"},"change_message_id":"09e05deb6338b563fc37357074c1b5209fe7f8ad","unresolved":false,"context_lines":[{"line_number":149,"context_line":"            if roles is not None:"},{"line_number":150,"context_line":"                roles \u003d roles.split(\u0027,\u0027)"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"            auth_url \u003d headers.get(\u0027X-Auth-Url\u0027)"},{"line_number":153,"context_line":"            if not auth_url:"},{"line_number":154,"context_line":"                # Import auth_token to have keystone_authtoken settings setup."},{"line_number":155,"context_line":"                auth_token_module \u003d \u0027keystoneclient.middleware.auth_token\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FXbM%3D","line":152,"in_reply_to":"AAAAUH%2F%2FY2o%3D","updated":"2014-01-14 15:50:07.000000000","message":"Yeah, I went back and forth with this trying to figure out if this is current behavior or a new security flaw, but I see your point: if we remove auth_token from the pipeline, even if you have your own keystone in place, it doesn\u0027t add/remove X-Auth-Url, therefore users would be able to forge it.\n\nHowever, we still read X-Auth-Url from the headers both from authtoken and auth_password, so I think the way to go for now would be to just separate X-Auth-Url handling from authtoken (and in the future from auth_password as well, keeping it in its own middleware). This way, regardless of multi-cloud or auth method (token or password), we could have proper auth_url.","commit_id":"d399a0f0b745385de1b1aef4ed9258be9b8110ac"}],"heat/tests/test_common_context.py":[{"author":{"_account_id":7256,"name":"Randall Burt","email":"randall.burt@rackspace.com","username":"randall-burt"},"change_message_id":"b4bb0b96fbcc340b543a7e6a62bf4e96fce1f85d","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        self.middleware.make_context \u003d mock.Mock()"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"        self.middleware.process_request(self.req)"},{"line_number":125,"context_line":"        _, kwargs \u003d self.middleware.make_context.call_args"},{"line_number":126,"context_line":"        self.assertEqual(\u0027bar\u0027, kwargs[\u0027auth_url\u0027])"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAUH%2F%2FxO0%3D","line":125,"updated":"2014-01-08 17:18:43.000000000","message":"Using the \"_\" here could be confused with _ from gettext which is usually imported. IMO, its ok to just have an unused variable.","commit_id":"74d1b5e52b6959888dbc034b1630e328914a5bf9"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"4061d6a4ce8863ad4d64f8fc49f79c1fcec46b1d","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        self.middleware.make_context \u003d mock.Mock()"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"        self.middleware.process_request(self.req)"},{"line_number":125,"context_line":"        _, kwargs \u003d self.middleware.make_context.call_args"},{"line_number":126,"context_line":"        self.assertEqual(\u0027bar\u0027, kwargs[\u0027auth_url\u0027])"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAUH%2F%2Fnc4%3D","line":125,"in_reply_to":"AAAAUH%2F%2FxO0%3D","updated":"2014-01-10 13:09:02.000000000","message":"There\u0027s no need to have an unused variable, and since https://review.openstack.org/#/c/62827/ they are not allowed.\n\nYou can just do:\n\n  kwargs \u003d self.middleware.make_context.call_args[1]","commit_id":"74d1b5e52b6959888dbc034b1630e328914a5bf9"},{"author":{"_account_id":7256,"name":"Randall Burt","email":"randall.burt@rackspace.com","username":"randall-burt"},"change_message_id":"44c269eb7990a2499f43c7538684d03c90705f24","unresolved":false,"context_lines":[{"line_number":109,"context_line":"        self.middleware.make_context \u003d mock.Mock()"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        self.middleware.process_request(self.req)"},{"line_number":112,"context_line":"        _, kwargs \u003d self.middleware.make_context.call_args"},{"line_number":113,"context_line":"        self.assertEqual(\u0027foo\u0027, kwargs[\u0027auth_url\u0027])"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"    @mock.patch.object(context.importutils, \u0027import_module\u0027)"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAUH%2F%2FaRE%3D","line":112,"updated":"2014-01-14 01:43:20.000000000","message":"Changed my mind base on Steve Hardy\u0027s comment on patch set  6. There\u0027s no reason for the placeholder here and it can break if ever we need to import the _ from gettext. Unlikely, but we can avoid it.","commit_id":"e877ac288f5955d29208b90243ddc2c8f36769f5"}]}