)]}'
{"id":"openstack%2Fkeystone~993207","triplet_id":"openstack%2Fkeystone~master~I235d78d3a6b76cddf61f9deb6ceacedf2706baf5","project":"openstack/keystone","branch":"master","attention_set":{"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-15 19:00:14.000000000","reason":"Someone else replied on the change"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I235d78d3a6b76cddf61f9deb6ceacedf2706baf5","subject":"Prevent nullable enabled column security bypasses and crashes","status":"NEW","created":"2026-06-13 09:48:23.000000000","updated":"2026-06-23 13:18:04.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":7,"unresolved_comment_count":5,"has_review_started":true,"meta_rev_id":"312c53ccd0f2f286b2d9c79317bf4ad6292d8e05","_number":993207,"virtual_id_number":993207,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-06-13 11:06:26.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-23 13:18:04.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"}],"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-06-13 11:06:26.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-15 19:00:14.000000000","updated_by":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"reviewer":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"state":"CC"},{"updated":"2026-06-23 13:18:04.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"}],"messages":[{"id":"1a578c3385994d302d7432fbf38519dccb16d1fa","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-13 09:48:23.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"2755964a3b3b611e8cd8097bd86d03c0d7fd4530","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-13 11:06:26.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9c7750fe0d994420bac38b4c2976aa45\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/3299e280d7624ab8ae099ce25c7114e0 : SUCCESS in 13m 21s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/24b5f344a9e84e1bad05cdf555738eef : SUCCESS in 4m 51s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/d341e27541b4489b9a79b32e152f689f : SUCCESS in 8m 06s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/32827527c25142ac804008fe265ba5e2 : SUCCESS in 10m 23s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/a0bb37041fc54cd48b7f509a3b5819e6 : SUCCESS in 11m 43s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1272cff4910845feb58e1d43e7d0dbe1 : SUCCESS in 16m 06s\n- grenade https://zuul.opendev.org/t/openstack/build/8f2a8d7968d241d3b5d269a3ef40c5e4 : SUCCESS in 1h 03m 46s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/aea0203cf5ea4b3eb916030a29d17074 : SUCCESS in 1h 16m 55s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/64158456473d453db99be614de5d9f07 : SUCCESS in 8m 34s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/4326e41459b1447d8879b9a5bf8586a7 : SUCCESS in 11m 12s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/01cbda7d03d049d2b40ac76ae91d9c9b : SUCCESS in 31m 01s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/a8a11baf7d33452c91894003c276c8d5 : FAILURE in 9m 26s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/facf373cbfc64840afdadd1c981e57b0 : FAILURE in 14m 35s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/201b632f0e9f42408dcf0ba84d9ceedb : SUCCESS in 36m 27s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/b73abb0a52a84af7ae16d638ad61ffa6 : SUCCESS in 13m 19s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8ace5ce2a606464facfea6a65096f230 : SUCCESS in 36m 13s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a5ae5a849ecf4f19b400fa2c91be639d : SUCCESS in 41m 55s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/33ccc7bbed324f6d85ee24c9a24779df : SUCCESS in 20m 17s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/b310acb639554a15b33d862bf402d30c : SUCCESS in 3m 39s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"d044a320f5853f53a90f6bb49c2f0a9e86dd4d33","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-06-15 19:00:14.000000000","message":"Patch Set 1:\n\n(6 comments)","accounts_in_message":[],"_revision_number":1},{"id":"4c4a6081ec1bbc238ffc782c8b4f1e278a5ee507","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-06-15 19:04:08.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"6ebff2886e23e07ac0c1052a99344354c71b6beb","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-17 01:19:24.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f0f3411f1cf04177bd33a1474f68f67b\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/de268cc877624a9baa96ce30f05e25a5 : POST_FAILURE in 19m 12s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/b3969c6e03e84484a5a4dea4d417c629 : SUCCESS in 18m 26s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/69d4689754ef48e2920d583c97a86b8c : SUCCESS in 31m 27s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"312c53ccd0f2f286b2d9c79317bf4ad6292d8e05","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-23 13:18:04.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"21231a9ab6c0148409033334bbfcb5e66603093e","revisions":{"21231a9ab6c0148409033334bbfcb5e66603093e":{"kind":"REWORK","_number":1,"created":"2026-06-13 09:48:23.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/07/993207/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/07/993207/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/07/993207/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/07/993207/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/07/993207/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/07/993207/1"}}},"commit":{"parents":[{"commit":"d490848342bfaec538edb7d5baf7c26604f7a10e","subject":"Fix nullable enabled column security vulnerabilities for user and project","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d490848342bfaec538edb7d5baf7c26604f7a10e"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-06-03 12:43:12.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-06-13 09:47:56.000000000","tz":120},"subject":"Prevent nullable enabled column security bypasses and crashes","message":"Prevent nullable enabled column security bypasses and crashes\n\nThe enabled column on user and project tables is nullable and can\ncontain NULL values from legacy data or API requests with enabled\u003dnull.\nThese NULL values were evaluated using Python truthiness checks, causing\ninconsistent security behavior across different code paths.\n\nTwo categories of fixes:\n\nSQL Backend:\n  - Domain-backed project deletion: enabled\u003dNone was treated as disabled\n    allowing deletion bypass. Now uses is not False check to treat NULL\n    as enabled (fail-open)\n  - Domain deletion: same issue, enabled\u003dNone allowed deletion of\n    ostensibly enabled domains\n  - User hybrid property: enabled\u003dNone caused authenticate() to raise\n    UserDisabled because not None evaluates to True. Now returns True\n    for None, maintaining fail-open policy\n\nLDAP Backend:\n  - _ldap_res_to_model: enabled\u003dNone from empty LDAP attribute list\n    caused int(None) TypeError crash and truthiness bugs. Now normalizes\n    to configured default before any processing\n  - create with enabled emulation: enabled\u003dNone was treated as disabled,\n    inconsistent with update path. Now normalizes to True\n  - ForbiddenAction check: not v fired on None, not just False. Now\n    uses explicit is False check\n  - Mask restore: orig_enabled\u003dNone discards mask computation. Now\n    falls back to configured default\n\nRelated-Bug: #2152715\nAssisted-By: qwen-3.6\nChange-Id: I235d78d3a6b76cddf61f9deb6ceacedf2706baf5\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/21231a9ab6c0148409033334bbfcb5e66603093e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/21231a9ab6c0148409033334bbfcb5e66603093e"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}