)]}'
{"id":"openstack%2Fmistral~1009481","triplet_id":"openstack%2Fmistral~stable%2F2026.2~Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b","project":"openstack/mistral","branch":"stable/2026.2","topic":"mistral-OSSA-2026-044","hashtags":[],"change_id":"Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b","subject":"Only allow the owner of a resource to share it","status":"MERGED","created":"2026-10-08 14:12:08.000000000","updated":"2026-10-08 19:00:42.000000000","submitted":"2026-10-08 18:58:45.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009481-mistral-OSSA-2026-044","meta_rev_id":"6539be40d5eb002f2bc5d5d9f4c61d82585c2a89","_number":1009481,"virtual_id_number":1009481,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-08 18:58:45.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-10-08 17:42:47.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-10-08 17:42:47.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-08 15:44:48.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"f334cee501f39660d76c0c983dc9d3bfcf6cdf70","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 14:12:08.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"5ab6792550e5086b90bee57af960a0391b518d1b","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 15:44:48.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/43d2d51f9bfe4d50ae3e5271f073dd80\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/311730da09b942e2a3acb6fc83e7e1b3 : SUCCESS in 2m 48s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/95374393d18644abbb216acd3ee72a84 : SUCCESS in 10m 45s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/7f755877558a4f7caa760e4bde19d6ca : SUCCESS in 13m 07s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/88b5fe0aee28490f9915350aeb44a837 : SUCCESS in 13m 46s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/80cd64034d3743969fb0e57f2f268468 : SUCCESS in 7m 15s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f21a91f3dd984641a31da473453823d5 : SUCCESS in 5m 48s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/5f1f8c2819844e1080cfaed5fe48c6ac : SUCCESS in 18m 00s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/ed645058c1e3418b92f6c2be6a934ac9 : SUCCESS in 32m 36s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6b94c69f5877497382dc45a9c6453ea2 : SUCCESS in 41m 19s","accounts_in_message":[],"_revision_number":1},{"id":"b94ad9f88c66d3e96e69ee6212bf7602aeba7f23","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 17:42:47.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"daea7987f5dff8ee68792b4763f7182ca640833d","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 17:45:37.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"e6844fe0e313a47deb958bffe23663ff14db9390","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 18:58:45.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b7e375b374bf42ce9fa2a62bfa14d655\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3fb2a7f76cd2415aa38edb82683576c4 : SUCCESS in 4m 14s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/a53a370467ad47feb03b4beec60be50c : SUCCESS in 14m 05s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/48577cb70ee34a16893c73651e3ef418 : SUCCESS in 11m 48s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5964409034564c349a1a91e0a4488c77 : SUCCESS in 9m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/bf81e2486c014f6cb7f7ed81ab9026b4 : SUCCESS in 4m 22s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/c8d887a2ddd34303a2f49091b2e3986d : SUCCESS in 39m 04s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ed3d048eee1c4ca39580f1fc881bfb4f : SUCCESS in 18m 15s","accounts_in_message":[],"_revision_number":1},{"id":"c69db11038c0fe0837f70c891cf192a9b127b543","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 18:58:45.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"6539be40d5eb002f2bc5d5d9f4c61d82585c2a89","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:00:42.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c2542c0f13f24bf2982c5b93d55c0bfb\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1455e3d253d846f59bb6ea37b96b2cc8 : SUCCESS in 47s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/989f971290414e34808267ed53e3e29f : SUCCESS in 47s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"9c05876bd1a74f60a1a07ce06e7daf556e1fe49c","revisions":{"9c05876bd1a74f60a1a07ce06e7daf556e1fe49c":{"kind":"REWORK","_number":1,"created":"2026-10-08 14:12:08.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/81/1009481/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/81/1009481/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/81/1009481/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/81/1009481/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/81/1009481/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/81/1009481/1"}}},"commit":{"parents":[{"commit":"739f6a6cfc13da69b409f35a8e75766495ff7fa8","subject":"Resolve own-project cron trigger in create_or_update_cron_trigger","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/739f6a6cfc13da69b409f35a8e75766495ff7fa8"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-26 19:29:26.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-10-08 14:11:11.000000000","tz":120},"subject":"Only allow the owner of a resource to share it","message":"Only allow the owner of a resource to share it\n\nSharing a workflow (POST /v2/workflows/\u003cid\u003e/members) only verified that\nthe caller could fetch the workflow definition and that its scope was\nprivate. The secure query that fetches the definition also returns\nresources shared with the caller through an accepted membership, so a\nproject that a workflow was shared with - once it accepted the share -\ncould re-share the owner\u0027s private workflow with an arbitrary third\nproject.\n\nThe resulting ResourceMember row is stamped with the re-sharing\nproject\u0027s id (the caller), not the owner\u0027s, so:\n\n* the real owner can neither list nor delete that membership;\n* the third project can accept it and thereby read and execute the\n  owner\u0027s private workflow, which the owner never shared with it;\n* only the re-sharing project, not the owner, can revoke it.\n\nReject the share unless the caller is the owner of the resource\n(wf_db.project_id \u003d\u003d security.get_project_id()), with a 403. This does\nnot affect the previously reported \"pending\" case, where the member\ncannot see the workflow yet and the fetch already fails with 404.\n\nCloses-Bug: #2161277\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/9c05876bd1a74f60a1a07ce06e7daf556e1fe49c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/9c05876bd1a74f60a1a07ce06e7daf556e1fe49c"}]},"branch":"refs/heads/stable/2026.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}