)]}'
{"nova/api/openstack/compute/contrib/flavormanage.py":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"7bcd0387b094ca8b106d14418dc80c7e57f3cd71","unresolved":false,"context_lines":[{"line_number":16,"context_line":"from nova.api.openstack import extensions"},{"line_number":17,"context_line":"from nova.api.openstack import wsgi"},{"line_number":18,"context_line":"from nova.compute import flavors"},{"line_number":19,"context_line":"from nova import context as nova_context"},{"line_number":20,"context_line":"from nova import exception"},{"line_number":21,"context_line":"from nova.i18n import _"},{"line_number":22,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"dac4157f_d6c57a8e","line":19,"updated":"2015-04-21 10:37:44.000000000","message":"I guess you forget remove this line","commit_id":"a2d19ffa6d3ba7752d07048f97ec9eb0dbc7323f"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"7bcd0387b094ca8b106d14418dc80c7e57f3cd71","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"class FlavorManageController(wsgi.Controller):"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"    \"\"\"The Flavor Lifecycle API controller for the OpenStack API.\"\"\""},{"line_number":30,"context_line":"    _view_builder_class \u003d flavors_view.ViewBuilder"},{"line_number":31,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"dac4157f_76ba2e0c","line":28,"updated":"2015-04-21 10:37:44.000000000","message":"This is needless change.","commit_id":"a2d19ffa6d3ba7752d07048f97ec9eb0dbc7323f"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"7bcd0387b094ca8b106d14418dc80c7e57f3cd71","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        authorize(context)"},{"line_number":39,"context_line":"        try:"},{"line_number":40,"context_line":"            flavor \u003d flavors.get_flavor_by_flavor_id("},{"line_number":41,"context_line":"                id, ctxt\u003dcontext, read_deleted\u003d\"no\")"},{"line_number":42,"context_line":"        except exception.FlavorNotFound as e:"},{"line_number":43,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003de.format_message())"},{"line_number":44,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"dac4157f_56384aa0","line":41,"updated":"2015-04-21 10:37:44.000000000","message":"ditto","commit_id":"a2d19ffa6d3ba7752d07048f97ec9eb0dbc7323f"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"7bcd0387b094ca8b106d14418dc80c7e57f3cd71","unresolved":false,"context_lines":[{"line_number":94,"context_line":"            raise webob.exc.HTTPBadRequest(explanation\u003dexc.format_message())"},{"line_number":95,"context_line":"        except exception.FlavorCreateFailed as exc:"},{"line_number":96,"context_line":"            raise webob.exc.HTTPInternalServerError("},{"line_number":97,"context_line":"                explanation\u003dexc.format_message())"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"        return self._view_builder.show(req, flavor)"},{"line_number":100,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"dac4157f_1642d210","line":97,"updated":"2015-04-21 10:37:44.000000000","message":"ditto","commit_id":"a2d19ffa6d3ba7752d07048f97ec9eb0dbc7323f"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"7bcd0387b094ca8b106d14418dc80c7e57f3cd71","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"class Flavormanage(extensions.ExtensionDescriptor):"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    \"\"\"Flavor create/delete API support.\"\"\""},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    name \u003d \"FlavorManage\""}],"source_content_type":"text/x-python","patch_set":3,"id":"dac4157f_b647a61c","line":103,"updated":"2015-04-21 10:37:44.000000000","message":"ditto","commit_id":"a2d19ffa6d3ba7752d07048f97ec9eb0dbc7323f"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f1bf5f0632c4996ff37e3cba6c4866e7d0a1607c","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"        # NOTE(alex_xu): back-compatible with db layer hard-code admin"},{"line_number":59,"context_line":"        # permission checks."},{"line_number":60,"context_line":"        nova_context.require_admin_context(context)"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"        if not self.is_valid_body(body, \u0027flavor\u0027):"},{"line_number":63,"context_line":"            msg \u003d _(\"Invalid request body\")"}],"source_content_type":"text/x-python","patch_set":4,"id":"dac4157f_af297f39","side":"PARENT","line":60,"updated":"2015-04-21 14:13:50.000000000","message":"This is OK, even my comment on line 82","commit_id":"b8947eef39272fee939818f383dd21be612e97cc"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f1bf5f0632c4996ff37e3cba6c4866e7d0a1607c","unresolved":false,"context_lines":[{"line_number":36,"context_line":"        authorize(context)"},{"line_number":37,"context_line":"        try:"},{"line_number":38,"context_line":"            flavor \u003d flavors.get_flavor_by_flavor_id("},{"line_number":39,"context_line":"                    id, ctxt\u003dcontext, read_deleted\u003d\"no\")"},{"line_number":40,"context_line":"        except exception.FlavorNotFound as e:"},{"line_number":41,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003de.format_message())"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"dac4157f_cfa5d304","line":39,"updated":"2015-04-21 14:13:50.000000000","message":"This seems different however, seems the elevated context check always applied here, even if that was a bug.","commit_id":"ced60b1d1b1608dc8229741b207a95498bc0b212"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f1c1b4d2ee837e0d4b16fa25cd72a95317a6bac5","unresolved":false,"context_lines":[{"line_number":36,"context_line":"        authorize(context)"},{"line_number":37,"context_line":"        try:"},{"line_number":38,"context_line":"            flavor \u003d flavors.get_flavor_by_flavor_id("},{"line_number":39,"context_line":"                    id, ctxt\u003dcontext, read_deleted\u003d\"no\")"},{"line_number":40,"context_line":"        except exception.FlavorNotFound as e:"},{"line_number":41,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003de.format_message())"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"bab921fb_521d3465","line":39,"in_reply_to":"dac4157f_70afad94","updated":"2015-04-22 19:48:14.000000000","message":"@Alex, looking at another case:\n\nhttps://review.openstack.org/#/c/160088/9/nova/api/openstack/compute/contrib/hosts.py\n\nDoesn\u0027t that make this pointless?\n\nhttp://git.openstack.org/cgit/openstack/nova/tree/etc/nova/policy.json#n91","commit_id":"ced60b1d1b1608dc8229741b207a95498bc0b212"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"cad529adeb9e69a034e24e68e46f73ef1c00a729","unresolved":false,"context_lines":[{"line_number":36,"context_line":"        authorize(context)"},{"line_number":37,"context_line":"        try:"},{"line_number":38,"context_line":"            flavor \u003d flavors.get_flavor_by_flavor_id("},{"line_number":39,"context_line":"                    id, ctxt\u003dcontext, read_deleted\u003d\"no\")"},{"line_number":40,"context_line":"        except exception.FlavorNotFound as e:"},{"line_number":41,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003de.format_message())"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"dac4157f_9e714bab","line":39,"in_reply_to":"dac4157f_cfa5d304","updated":"2015-04-21 15:34:48.000000000","message":"There isn\u0027t admin permission check at db layer https://github.com/openstack/nova/blob/stable/juno/nova/db/sqlalchemy/api.py#L4499 before. So this line always can pass whatever admin or non-admin context.","commit_id":"ced60b1d1b1608dc8229741b207a95498bc0b212"},{"author":{"_account_id":13637,"name":"Divya K Konoor","email":"dikonoor@in.ibm.com","username":"dikonoor"},"change_message_id":"31e269cb2bacd00e3ec1daa3307609bb88ca84eb","unresolved":false,"context_lines":[{"line_number":36,"context_line":"        authorize(context)"},{"line_number":37,"context_line":"        try:"},{"line_number":38,"context_line":"            flavor \u003d flavors.get_flavor_by_flavor_id("},{"line_number":39,"context_line":"                    id, ctxt\u003dcontext, read_deleted\u003d\"no\")"},{"line_number":40,"context_line":"        except exception.FlavorNotFound as e:"},{"line_number":41,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003de.format_message())"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"dac4157f_70afad94","line":39,"in_reply_to":"dac4157f_cfa5d304","updated":"2015-04-22 04:32:47.000000000","message":"authorize(context) uses the context associated with the right user and not an elevated context. Thus the policy enforcement that happens at this line controls the permissions using policy.json and for the right context. Like Alex pointed out, the elevated context does not matter for the bug we are trying to resolve because we don\u0027t use the elevated context for policy enforcement and the admin permission check that used to exist at the db layer no longer exists.Done","commit_id":"ced60b1d1b1608dc8229741b207a95498bc0b212"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3485c8aa0fbae1a8615a0d85e10178efbbc1e5b5","unresolved":false,"context_lines":[{"line_number":40,"context_line":"        except exception.FlavorNotFound as e:"},{"line_number":41,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003de.format_message())"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"        flavors.destroy(flavor[\u0027name\u0027])"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"        return webob.Response(status_int\u003d202)"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"dac4157f_5a3cbfe1","line":43,"updated":"2015-04-22 09:15:38.000000000","message":"oh wait, sorry, I see its here I should be looking:\nhttps://github.com/openstack/nova/blob/master/nova/compute/flavors.py#L185","commit_id":"ced60b1d1b1608dc8229741b207a95498bc0b212"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"669f471426f620be3277a0b74b2396bfe0840196","unresolved":false,"context_lines":[{"line_number":40,"context_line":"        except exception.FlavorNotFound as e:"},{"line_number":41,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003de.format_message())"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"        flavors.destroy(flavor[\u0027name\u0027])"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"        return webob.Response(status_int\u003d202)"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"dac4157f_05da6878","line":43,"in_reply_to":"dac4157f_5a3cbfe1","updated":"2015-04-22 09:22:12.000000000","message":"Yeah, that\u0027s just a fake context...","commit_id":"ced60b1d1b1608dc8229741b207a95498bc0b212"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f1bf5f0632c4996ff37e3cba6c4866e7d0a1607c","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        is_public \u003d vals.get(\u0027os-flavor-access:is_public\u0027, True)"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"        try:"},{"line_number":82,"context_line":"            flavor \u003d flavors.create(name, memory, vcpus, root_gb,"},{"line_number":83,"context_line":"                                    ephemeral_gb\u003dephemeral_gb,"},{"line_number":84,"context_line":"                                    flavorid\u003dflavorid, swap\u003dswap,"},{"line_number":85,"context_line":"                                    rxtx_factor\u003drxtx_factor,"}],"source_content_type":"text/x-python","patch_set":4,"id":"dac4157f_8f3b5bd1","line":82,"updated":"2015-04-21 14:13:50.000000000","message":"I see this uses admin context here:\nhttps://github.com/openstack/nova/blob/master/nova/compute/flavors.py#L175","commit_id":"ced60b1d1b1608dc8229741b207a95498bc0b212"}]}