)]}'
{"security-guide/source/dashboard/checklist.rst":[{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"401c031d45b03535a61bce4a8816c8f66b9bb16c","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":".. code:: console"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\"  /etc/openstack-dashboard/local_settings | egrep \"root horizon\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"**Pass:** If user and group ownership of the config file is set to root and"},{"line_number":25,"context_line":"horizon respectively. The above commands show output of root horizon."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a26ad4f_338da47b","line":22,"updated":"2015-10-30 02:29:31.000000000","message":"(Applies throughout this document) /etc/openstack-dashboard/local_settings should be /etc/openstack-dashboard/local_settings.py","commit_id":"51516bafe7eb8a81869084bb286a46a8ba37d8f0"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"0294bd849a91e5dfe5039ac1b11c657f6296a169","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":".. code:: console"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\"  /etc/openstack-dashboard/local_settings | egrep \"root horizon\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"**Pass:** If user and group ownership of the config file is set to root and"},{"line_number":25,"context_line":"horizon respectively. The above commands show output of root horizon."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a26ad4f_93e91883","line":22,"in_reply_to":"1a26ad4f_338da47b","updated":"2015-10-30 02:58:35.000000000","message":"Done","commit_id":"51516bafe7eb8a81869084bb286a46a8ba37d8f0"},{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"401c031d45b03535a61bce4a8816c8f66b9bb16c","unresolved":false,"context_lines":[{"line_number":88,"context_line":"CSRF (Cross-site request forgery) is an attack which forces an end user to"},{"line_number":89,"context_line":"execute unauthorized commands on a web application in which he/she is currently"},{"line_number":90,"context_line":"authenticated. A successful CSRF exploit can compromise end user data and"},{"line_number":91,"context_line":"operations in case of normal user. If the targeted end user has an admin"},{"line_number":92,"context_line":"priviledges, this can compromise the entire web application."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"**Pass:** If value of parameter ``CSRF_COOKIE_SECURE`` in"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a26ad4f_930a7820","line":91,"updated":"2015-10-30 02:29:31.000000000","message":"\"has an admin\" -\u003e \"has admin\"","commit_id":"51516bafe7eb8a81869084bb286a46a8ba37d8f0"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"0294bd849a91e5dfe5039ac1b11c657f6296a169","unresolved":false,"context_lines":[{"line_number":88,"context_line":"CSRF (Cross-site request forgery) is an attack which forces an end user to"},{"line_number":89,"context_line":"execute unauthorized commands on a web application in which he/she is currently"},{"line_number":90,"context_line":"authenticated. A successful CSRF exploit can compromise end user data and"},{"line_number":91,"context_line":"operations in case of normal user. If the targeted end user has an admin"},{"line_number":92,"context_line":"priviledges, this can compromise the entire web application."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"**Pass:** If value of parameter ``CSRF_COOKIE_SECURE`` in"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a26ad4f_5304e048","line":91,"in_reply_to":"1a26ad4f_930a7820","updated":"2015-10-30 02:58:35.000000000","message":"Done","commit_id":"51516bafe7eb8a81869084bb286a46a8ba37d8f0"},{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"401c031d45b03535a61bce4a8816c8f66b9bb16c","unresolved":false,"context_lines":[{"line_number":89,"context_line":"execute unauthorized commands on a web application in which he/she is currently"},{"line_number":90,"context_line":"authenticated. A successful CSRF exploit can compromise end user data and"},{"line_number":91,"context_line":"operations in case of normal user. If the targeted end user has an admin"},{"line_number":92,"context_line":"priviledges, this can compromise the entire web application."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"**Pass:** If value of parameter ``CSRF_COOKIE_SECURE`` in"},{"line_number":95,"context_line":":file:`/etc/openstack-dashboard/local_settings` is set to ``True``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a26ad4f_131f4860","line":92,"updated":"2015-10-30 02:29:31.000000000","message":"priviledges -\u003e privileges","commit_id":"51516bafe7eb8a81869084bb286a46a8ba37d8f0"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"0294bd849a91e5dfe5039ac1b11c657f6296a169","unresolved":false,"context_lines":[{"line_number":89,"context_line":"execute unauthorized commands on a web application in which he/she is currently"},{"line_number":90,"context_line":"authenticated. A successful CSRF exploit can compromise end user data and"},{"line_number":91,"context_line":"operations in case of normal user. If the targeted end user has an admin"},{"line_number":92,"context_line":"priviledges, this can compromise the entire web application."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"**Pass:** If value of parameter ``CSRF_COOKIE_SECURE`` in"},{"line_number":95,"context_line":":file:`/etc/openstack-dashboard/local_settings` is set to ``True``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a26ad4f_33f9244e","line":92,"in_reply_to":"1a26ad4f_131f4860","updated":"2015-10-30 02:58:35.000000000","message":"Done","commit_id":"51516bafe7eb8a81869084bb286a46a8ba37d8f0"},{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"401c031d45b03535a61bce4a8816c8f66b9bb16c","unresolved":false,"context_lines":[{"line_number":152,"context_line":":file:`/etc/openstack-dashboard/local_settings` is set to ``off``."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"**Fail:** If value of parameter ``password_autocomplete`` in"},{"line_number":155,"context_line":":file:`/etc/openstack-dashboard/local_settings` is set to ``on``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a26ad4f_b380d447","line":155,"updated":"2015-10-30 02:29:31.000000000","message":"I would also add checking for disable_password_reveal\u003dTrue (new in Kilo) to this checklist.\n\nDescribed here:\nhttp://docs.openstack.org/developer/horizon/topics/settings.html","commit_id":"51516bafe7eb8a81869084bb286a46a8ba37d8f0"},{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"1424ed3d2afe723a12349d176db257854d5216fc","unresolved":false,"context_lines":[{"line_number":136,"context_line":":file:`/etc/openstack-dashboard/local_settings.py` is set to ``False``."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Recommended in: :doc:`cookies`."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Check-Dashboard-07: Is ``password_autocomplete`` set to ``False``?"},{"line_number":141,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a26ad4f_59439f42","line":139,"updated":"2015-10-30 03:19:08.000000000","message":"Should this have a tag as well?\n.. _check_dashboard_07:","commit_id":"f14da89a0edbe778011f51afeb25e6ce0d04e6d5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d2a30379cef4c3f19c1995e6f604092adf683cd2","unresolved":false,"context_lines":[{"line_number":136,"context_line":":file:`/etc/openstack-dashboard/local_settings.py` is set to ``False``."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Recommended in: :doc:`cookies`."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Check-Dashboard-07: Is ``password_autocomplete`` set to ``False``?"},{"line_number":141,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da85f559_256ce69b","line":139,"in_reply_to":"1a26ad4f_59439f42","updated":"2015-11-06 23:12:02.000000000","message":"Done","commit_id":"f14da89a0edbe778011f51afeb25e6ce0d04e6d5"},{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"21096b0cf8de45000e73a9e1c4868b04822599c4","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":"**Fail:** If value of parameter ``password_autocomplete`` in"},{"line_number":155,"context_line":":file:`/etc/openstack-dashboard/local_settings.py` is set to ``on``."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Check-Dashboard-07: Is ``disable_password_reveal`` set to ``True``?"},{"line_number":158,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a26ad4f_391a636f","line":156,"updated":"2015-10-30 03:17:18.000000000","message":"Should this have a tag as well?\n\n.. _check_dashboard_08:","commit_id":"f14da89a0edbe778011f51afeb25e6ce0d04e6d5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d2a30379cef4c3f19c1995e6f604092adf683cd2","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":"**Fail:** If value of parameter ``password_autocomplete`` in"},{"line_number":155,"context_line":":file:`/etc/openstack-dashboard/local_settings.py` is set to ``on``."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Check-Dashboard-07: Is ``disable_password_reveal`` set to ``True``?"},{"line_number":158,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da85f559_e5049ec7","line":156,"in_reply_to":"1a26ad4f_391a636f","updated":"2015-11-06 23:12:02.000000000","message":"Done","commit_id":"f14da89a0edbe778011f51afeb25e6ce0d04e6d5"},{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"21096b0cf8de45000e73a9e1c4868b04822599c4","unresolved":false,"context_lines":[{"line_number":154,"context_line":"**Fail:** If value of parameter ``password_autocomplete`` in"},{"line_number":155,"context_line":":file:`/etc/openstack-dashboard/local_settings.py` is set to ``on``."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Check-Dashboard-07: Is ``disable_password_reveal`` set to ``True``?"},{"line_number":158,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Similar to the previous check, it is recommended not to reveal password fields."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a26ad4f_8e132f66","line":157,"updated":"2015-10-30 03:17:18.000000000","message":"Check-Dashboard-07 -\u003e Check-Dashboard-08","commit_id":"f14da89a0edbe778011f51afeb25e6ce0d04e6d5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d2a30379cef4c3f19c1995e6f604092adf683cd2","unresolved":false,"context_lines":[{"line_number":154,"context_line":"**Fail:** If value of parameter ``password_autocomplete`` in"},{"line_number":155,"context_line":":file:`/etc/openstack-dashboard/local_settings.py` is set to ``on``."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Check-Dashboard-07: Is ``disable_password_reveal`` set to ``True``?"},{"line_number":158,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Similar to the previous check, it is recommended not to reveal password fields."}],"source_content_type":"text/x-rst","patch_set":2,"id":"da85f559_050a02d3","line":157,"in_reply_to":"1a26ad4f_8e132f66","updated":"2015-11-06 23:12:02.000000000","message":"Done","commit_id":"f14da89a0edbe778011f51afeb25e6ce0d04e6d5"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"1780276296f160b188e8e45e4603a80ccc0b0b9c","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":".. _check_dashboard_07:"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Check-Dashboard-07: Is ``password_autocomplete`` set to ``False``?"},{"line_number":143,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Common feature that applications use to provide users a convenience is to cache"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_80102050","line":142,"updated":"2015-11-06 23:45:52.000000000","message":"Is this really needed? In my understand, Many recent web browser ignore autocomplete parameter setting in HTML, which should be set by user side setting to control usage of very complex password.","commit_id":"3e74088675249a3eb1da9e9cc4d42326b89a4358"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"4630e04f9ba42a9940ac4af068944a6663cfacb1","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":".. _check_dashboard_07:"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Check-Dashboard-07: Is ``password_autocomplete`` set to ``False``?"},{"line_number":143,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Common feature that applications use to provide users a convenience is to cache"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_2db1bbe1","line":142,"in_reply_to":"da85f559_80102050","updated":"2015-11-10 15:24:41.000000000","message":"i think it\u0027s valuable to have this information here, but maybe we should add a note about the client side behavior?","commit_id":"3e74088675249a3eb1da9e9cc4d42326b89a4358"}]}