)]}'
{"id":"openstack%2Fmistral~1009489","triplet_id":"openstack%2Fmistral~stable%2F2026.1~Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b","project":"openstack/mistral","branch":"stable/2026.1","topic":"mistral-OSSA-2026-044","hashtags":[],"change_id":"Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b","subject":"Only allow the owner of a resource to share it","status":"MERGED","created":"2026-10-08 14:14:04.000000000","updated":"2026-10-08 19:01:41.000000000","submitted":"2026-10-08 19:01:41.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009489-mistral-OSSA-2026-044","meta_rev_id":"d4d1ac7e03fda41f912de1541aba8f49b84a69c7","_number":1009489,"virtual_id_number":1009489,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-08 19:01:41.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-10-08 17:44:00.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-10-08 17:44:00.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-08 16:03:35.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"ee11f30c1611cdf94c1f26cf45bca1b3e7227f22","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 14:14:04.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"02c2819eb75fee6ad1ec88b15c018a16b72b6e1a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 16:03:35.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8bef6ebadbff4aa9aac7cdb35806ffaf\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a5a87674f69a4057b8e29d2ed6deabc7 : SUCCESS in 4m 36s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/0af475257b444d23990c0c44dfb50c24 : SUCCESS in 10m 34s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f1215bdd4f174605b0d6ea8e3098a251 : SUCCESS in 10m 55s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/dd329fc347f642eea80ccfbd9f58297c : SUCCESS in 14m 10s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e04daf7be242469abf92321decca218b : SUCCESS in 9m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/85865bbeed464bb5a102a6e51949e0a2 : SUCCESS in 6m 18s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/eb63b7b04976477e953e31e8110baf30 : SUCCESS in 16m 08s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/12796e110504489ea95b71bb3ed6da60 : SUCCESS in 31m 20s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/deea7084fd0640c191ff6019d03806c6 : SUCCESS in 32m 50s","accounts_in_message":[],"_revision_number":1},{"id":"2d1b263c9ed11a2a04d02b68e1b691a3bd0fd6a1","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 17:44:00.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"cefd550e3861410bfef93e3306d6026459b45663","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 17:47:12.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"7b6b1a53438f24d68e640d5e21c7213932f675e3","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:01:41.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/20cd87f1af6b4d55bf9b5c8d69bb3070\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/25d947e6d62b43ada0e5096c6a5d76da : SUCCESS in 4m 39s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/f64caae5692f421d8e72b133d21f11f5 : SUCCESS in 10m 43s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/8b098bed55d142588e06732a47ec77a0 : SUCCESS in 10m 56s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/68ed522dab7e41b1a08a983d61276a1a : SUCCESS in 8m 36s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/feb1a455cfa14054aa0e4f8326517a25 : SUCCESS in 5m 45s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/64761401bd984cdbb226506e018695c2 : SUCCESS in 40m 22s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e6d95b8d3ab94923a93330bef2236856 : SUCCESS in 52m 55s","accounts_in_message":[],"_revision_number":1},{"id":"d4d1ac7e03fda41f912de1541aba8f49b84a69c7","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:01:41.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"8e7f5dad1a887ac951002f16120843ec5dd7ae96","revisions":{"8e7f5dad1a887ac951002f16120843ec5dd7ae96":{"kind":"REWORK","_number":1,"created":"2026-10-08 14:14:04.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/89/1009489/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/89/1009489/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/89/1009489/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/89/1009489/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/89/1009489/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/89/1009489/1"}}},"commit":{"parents":[{"commit":"b80c4cf98f8abf16d3930849222fc21319e77521","subject":"Resolve own-project cron trigger in create_or_update_cron_trigger","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/b80c4cf98f8abf16d3930849222fc21319e77521"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-26 19:29:26.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-10-08 14:13:49.000000000","tz":120},"subject":"Only allow the owner of a resource to share it","message":"Only allow the owner of a resource to share it\n\nSharing a workflow (POST /v2/workflows/\u003cid\u003e/members) only verified that\nthe caller could fetch the workflow definition and that its scope was\nprivate. The secure query that fetches the definition also returns\nresources shared with the caller through an accepted membership, so a\nproject that a workflow was shared with - once it accepted the share -\ncould re-share the owner\u0027s private workflow with an arbitrary third\nproject.\n\nThe resulting ResourceMember row is stamped with the re-sharing\nproject\u0027s id (the caller), not the owner\u0027s, so:\n\n* the real owner can neither list nor delete that membership;\n* the third project can accept it and thereby read and execute the\n  owner\u0027s private workflow, which the owner never shared with it;\n* only the re-sharing project, not the owner, can revoke it.\n\nReject the share unless the caller is the owner of the resource\n(wf_db.project_id \u003d\u003d security.get_project_id()), with a 403. This does\nnot affect the previously reported \"pending\" case, where the member\ncannot see the workflow yet and the fetch already fails with 404.\n\nCloses-Bug: #2161277\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/8e7f5dad1a887ac951002f16120843ec5dd7ae96"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/8e7f5dad1a887ac951002f16120843ec5dd7ae96"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}