)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"bb528f84f30d4c00c4141786c7328bd548b9bcfb","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2016-08-24 10:04:30 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Updated OSSN-0073"},{"line_number":8,"context_line":"Added information about Horizon dashboard leaks"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Change-Id: I4c5e8803758ac37b941bf50da7692ef09e2f6f57"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"fa7ab95a_ffb694f7","line":8,"range":{"start_line":8,"start_character":24,"end_line":8,"end_character":31},"updated":"2016-08-29 21:31:19.000000000","message":"lower case for project names","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"3f732a54808bd1aa6d7f718c26f92996cdf692af","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2016-08-24 10:04:30 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Updated OSSN-0073"},{"line_number":8,"context_line":"Added information about Horizon dashboard leaks"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Change-Id: I4c5e8803758ac37b941bf50da7692ef09e2f6f57"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"fa7ab95a_01edc4b6","line":8,"range":{"start_line":8,"start_character":24,"end_line":8,"end_character":31},"in_reply_to":"fa7ab95a_ffb694f7","updated":"2016-09-01 17:42:08.000000000","message":"Done","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"}],"security-notes/OSSN-0073":[{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"aab11ccf052e01fb4c175ccc8a78697fd64f2204","unresolved":false,"context_lines":[{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of the internal URL"},{"line_number":6,"context_line":"of keystone. If the internal network is different than the public network, the"},{"line_number":7,"context_line":"IP address of the internal network will be displayed by the horizon, which can"},{"line_number":8,"context_line":"expose sensitive information - internal IP address. The cookie \"login_region\""},{"line_number":9,"context_line":"will be set to the value configured as OPENSTACK_KEYSTONE_URL."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_4454ae20","line":8,"range":{"start_line":8,"start_character":64,"end_line":8,"end_character":76},"updated":"2016-08-18 17:07:24.000000000","message":"I am sure what the relevance of the cookie here is, could it be made a bit more clear, like one more sentence to explain why that matter?","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"a3255001b81388f45ca25859cf93489af3638791","unresolved":false,"context_lines":[{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of the internal URL"},{"line_number":6,"context_line":"of keystone. If the internal network is different than the public network, the"},{"line_number":7,"context_line":"IP address of the internal network will be displayed by the horizon, which can"},{"line_number":8,"context_line":"expose sensitive information - internal IP address. The cookie \"login_region\""},{"line_number":9,"context_line":"will be set to the value configured as OPENSTACK_KEYSTONE_URL."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1ac06dbe_28aa08d5","line":8,"range":{"start_line":8,"start_character":64,"end_line":8,"end_character":76},"in_reply_to":"3ac371cc_4454ae20","updated":"2016-08-19 17:17:54.000000000","message":"Done","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"aab11ccf052e01fb4c175ccc8a78697fd64f2204","unresolved":false,"context_lines":[{"line_number":9,"context_line":"will be set to the value configured as OPENSTACK_KEYSTONE_URL."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Keystone, Horizon"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_c43eded9","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":8},"updated":"2016-08-18 17:07:24.000000000","message":"how is keystone affected.?","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"a3255001b81388f45ca25859cf93489af3638791","unresolved":false,"context_lines":[{"line_number":9,"context_line":"will be set to the value configured as OPENSTACK_KEYSTONE_URL."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Keystone, Horizon"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1ac06dbe_88afbce2","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":8},"in_reply_to":"3ac371cc_c43eded9","updated":"2016-08-19 17:17:54.000000000","message":"Done","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"aab11ccf052e01fb4c175ccc8a78697fd64f2204","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Keystone, Horizon"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"},{"line_number":16,"context_line":"internalURL is not a bug either way, one views the internalURL, either it\u0027s a"},{"line_number":17,"context_line":"freely accessible endpoint to authorized users, or it\u0027s hidden behind a firewall."},{"line_number":18,"context_line":"Also, the data for internal URLs are freely available in the catalog and the"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_c72380a6","line":15,"range":{"start_line":15,"start_character":20,"end_line":15,"end_character":36},"updated":"2016-08-18 17:07:24.000000000","message":"would it be better to say something like \"This is not a bug in horizon, but a possible misconfiguration issue\"","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"a3255001b81388f45ca25859cf93489af3638791","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Keystone, Horizon"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"},{"line_number":16,"context_line":"internalURL is not a bug either way, one views the internalURL, either it\u0027s a"},{"line_number":17,"context_line":"freely accessible endpoint to authorized users, or it\u0027s hidden behind a firewall."},{"line_number":18,"context_line":"Also, the data for internal URLs are freely available in the catalog and the"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1ac06dbe_68ac00ee","line":15,"range":{"start_line":15,"start_character":20,"end_line":15,"end_character":36},"in_reply_to":"3ac371cc_c72380a6","updated":"2016-08-19 17:17:54.000000000","message":"Done","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"aab11ccf052e01fb4c175ccc8a78697fd64f2204","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"},{"line_number":16,"context_line":"internalURL is not a bug either way, one views the internalURL, either it\u0027s a"},{"line_number":17,"context_line":"freely accessible endpoint to authorized users, or it\u0027s hidden behind a firewall."},{"line_number":18,"context_line":"Also, the data for internal URLs are freely available in the catalog and the"},{"line_number":19,"context_line":"catalog is not considered private information."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_c771c0aa","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":11},"updated":"2016-08-18 17:07:24.000000000","message":"a nit : space before URL","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"aab11ccf052e01fb4c175ccc8a78697fd64f2204","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"},{"line_number":16,"context_line":"internalURL is not a bug either way, one views the internalURL, either it\u0027s a"},{"line_number":17,"context_line":"freely accessible endpoint to authorized users, or it\u0027s hidden behind a firewall."},{"line_number":18,"context_line":"Also, the data for internal URLs are freely available in the catalog and the"},{"line_number":19,"context_line":"catalog is not considered private information."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_676bac86","line":16,"range":{"start_line":16,"start_character":37,"end_line":16,"end_character":40},"updated":"2016-08-18 17:07:24.000000000","message":"can the sentence be rewrote?..something is not right about the sentence construction.","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"a3255001b81388f45ca25859cf93489af3638791","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"},{"line_number":16,"context_line":"internalURL is not a bug either way, one views the internalURL, either it\u0027s a"},{"line_number":17,"context_line":"freely accessible endpoint to authorized users, or it\u0027s hidden behind a firewall."},{"line_number":18,"context_line":"Also, the data for internal URLs are freely available in the catalog and the"},{"line_number":19,"context_line":"catalog is not considered private information."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1ac06dbe_a8b6f83a","line":16,"range":{"start_line":16,"start_character":37,"end_line":16,"end_character":40},"in_reply_to":"3ac371cc_676bac86","updated":"2016-08-19 17:17:54.000000000","message":"Done","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"a3255001b81388f45ca25859cf93489af3638791","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":" This seems to be a misconfiguration issue, instead of a real bug. Exposing the"},{"line_number":16,"context_line":"internalURL is not a bug either way, one views the internalURL, either it\u0027s a"},{"line_number":17,"context_line":"freely accessible endpoint to authorized users, or it\u0027s hidden behind a firewall."},{"line_number":18,"context_line":"Also, the data for internal URLs are freely available in the catalog and the"},{"line_number":19,"context_line":"catalog is not considered private information."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1ac06dbe_0882ac52","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":11},"in_reply_to":"3ac371cc_c771c0aa","updated":"2016-08-19 17:17:54.000000000","message":"Done","commit_id":"07193106f4db5d1651d24370448d01c91928d71b"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"d478972abc0077b59e5c94eb6b3c412b578cb50a","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of the internal URL"},{"line_number":6,"context_line":"of keystone."},{"line_number":7,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":8,"context_line":"OPENSTACK_KEYSTONE_URL. This URL contains the IP address of the internal"},{"line_number":9,"context_line":"network. If the internal network is different than the public network, the"},{"line_number":10,"context_line":"IP address of the internal network will be displayed by the horizon, which can"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1ac06dbe_c0e811e5","line":7,"range":{"start_line":7,"start_character":12,"end_line":7,"end_character":24},"updated":"2016-08-22 16:35:17.000000000","message":"Could you please make this a bit more clear on if the external uri is used or not, and when exactly the login_region cookie is being set","commit_id":"751a485e527d057d30e0f4d5ced150059a894390"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"b29078368c35dcdbd93a218f7fdd79451765ce1c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of the internal URL"},{"line_number":6,"context_line":"of keystone."},{"line_number":7,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":8,"context_line":"OPENSTACK_KEYSTONE_URL. This URL contains the IP address of the internal"},{"line_number":9,"context_line":"network. If the internal network is different than the public network, the"},{"line_number":10,"context_line":"IP address of the internal network will be displayed by the horizon, which can"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1ac06dbe_104545b2","line":7,"range":{"start_line":7,"start_character":12,"end_line":7,"end_character":24},"in_reply_to":"1ac06dbe_c0e811e5","updated":"2016-08-22 22:01:34.000000000","message":"So, the cookie \"login_region\" is set to the OPENSTACK_KEYSTONE_URL in the local_settings.py file. Usually, the OPENSTAKC_KEYSTONE_URL is the public URL, and hence the cookie url will also be the public one. If set to internal URL, then the login cookie URL will be the internal URL / IP.  So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to the public network, horizon leaks the values of the internal network IP addresses.","commit_id":"751a485e527d057d30e0f4d5ced150059a894390"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"d478972abc0077b59e5c94eb6b3c412b578cb50a","unresolved":false,"context_lines":[{"line_number":7,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":8,"context_line":"OPENSTACK_KEYSTONE_URL. This URL contains the IP address of the internal"},{"line_number":9,"context_line":"network. If the internal network is different than the public network, the"},{"line_number":10,"context_line":"IP address of the internal network will be displayed by the horizon, which can"},{"line_number":11,"context_line":"expose sensitive information - internal IP address."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1ac06dbe_80ac59a1","line":10,"range":{"start_line":10,"start_character":60,"end_line":10,"end_character":67},"updated":"2016-08-22 16:35:17.000000000","message":"exposed by the cookie?","commit_id":"751a485e527d057d30e0f4d5ced150059a894390"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"b29078368c35dcdbd93a218f7fdd79451765ce1c","unresolved":false,"context_lines":[{"line_number":7,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":8,"context_line":"OPENSTACK_KEYSTONE_URL. This URL contains the IP address of the internal"},{"line_number":9,"context_line":"network. If the internal network is different than the public network, the"},{"line_number":10,"context_line":"IP address of the internal network will be displayed by the horizon, which can"},{"line_number":11,"context_line":"expose sensitive information - internal IP address."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1ac06dbe_903e55d8","line":10,"range":{"start_line":10,"start_character":60,"end_line":10,"end_character":67},"in_reply_to":"1ac06dbe_80ac59a1","updated":"2016-08-22 22:01:34.000000000","message":"putting the OPENSTAKC_KEYSTONE_URL in the cookie and sending it to public network, horizon leaks the value of internal network\u0027s IP address. So, yes, exposed by the cookie.","commit_id":"751a485e527d057d30e0f4d5ced150059a894390"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"0ba860181163619eb772601da4f9ae9dd83f45ee","unresolved":false,"context_lines":[{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"},{"line_number":12,"context_line":"(by default), then the login cookie URL will be the internal URL / IP."},{"line_number":13,"context_line":"So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to"},{"line_number":14,"context_line":"the public network, horizon leaks the values of the internal network IP"},{"line_number":15,"context_line":"address."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1ac06dbe_686c3b08","line":12,"range":{"start_line":12,"start_character":61,"end_line":12,"end_character":69},"updated":"2016-08-24 01:06:00.000000000","message":"replace slash with \u0027or\u0027","commit_id":"3751958b9632a834b1b707d00c0d575d30b21c05"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"0ae6018220114c29e5b00985f49e899d778f5768","unresolved":false,"context_lines":[{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"},{"line_number":12,"context_line":"(by default), then the login cookie URL will be the internal URL / IP."},{"line_number":13,"context_line":"So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to"},{"line_number":14,"context_line":"the public network, horizon leaks the values of the internal network IP"},{"line_number":15,"context_line":"address."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1ac06dbe_bb15b29c","line":12,"range":{"start_line":12,"start_character":61,"end_line":12,"end_character":69},"in_reply_to":"1ac06dbe_686c3b08","updated":"2016-08-24 14:54:48.000000000","message":"Done","commit_id":"3751958b9632a834b1b707d00c0d575d30b21c05"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"0ba860181163619eb772601da4f9ae9dd83f45ee","unresolved":false,"context_lines":[{"line_number":14,"context_line":"the public network, horizon leaks the values of the internal network IP"},{"line_number":15,"context_line":"address."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Affected Services / Software ###"},{"line_number":18,"context_line":"Horizon"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Discussion ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1ac06dbe_a87ab3ba","line":17,"range":{"start_line":17,"start_character":22,"end_line":17,"end_character":23},"updated":"2016-08-24 01:06:00.000000000","message":"replace slash with \u0027and\u0027","commit_id":"3751958b9632a834b1b707d00c0d575d30b21c05"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"0ae6018220114c29e5b00985f49e899d778f5768","unresolved":false,"context_lines":[{"line_number":14,"context_line":"the public network, horizon leaks the values of the internal network IP"},{"line_number":15,"context_line":"address."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Affected Services / Software ###"},{"line_number":18,"context_line":"Horizon"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Discussion ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1ac06dbe_fb0f2a86","line":17,"range":{"start_line":17,"start_character":22,"end_line":17,"end_character":23},"in_reply_to":"1ac06dbe_a87ab3ba","updated":"2016-08-24 14:54:48.000000000","message":"Done","commit_id":"3751958b9632a834b1b707d00c0d575d30b21c05"},{"author":{"_account_id":20508,"name":"Mohit Motiani","email":"mohit.motiani@intel.com","username":"mohit.motiani"},"change_message_id":"5d3428ed903a4ab5bd51541f478173c0a7c0a3c8","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of"},{"line_number":6,"context_line":"the internal URL of keystone, as the default value for the identity"},{"line_number":7,"context_line":"service is \"internal URL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_1b87a1d8","line":5,"updated":"2016-08-24 15:54:17.000000000","message":"s:horizon/the horizon","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"2e28d6fbe9c99fa6d0c4d3baee082f03ef74fbe4","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of"},{"line_number":6,"context_line":"the internal URL of keystone, as the default value for the identity"},{"line_number":7,"context_line":"service is \"internal URL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_6e64f148","line":5,"in_reply_to":"1ac06dbe_1b87a1d8","updated":"2016-08-25 03:50:05.000000000","message":"In this case, horizon is a proper noun, and therefore doesn\u0027t need a definite article. The existing text is correct. \n\n(Same on L21)","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"4ae0120354f29680fc55c5c53bc627101e55069b","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of"},{"line_number":6,"context_line":"the internal URL of keystone, as the default value for the identity"},{"line_number":7,"context_line":"service is \"internal URL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_1e557d4f","line":5,"in_reply_to":"1ac06dbe_6e64f148","updated":"2016-08-25 16:08:51.000000000","message":"+1","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":20508,"name":"Mohit Motiani","email":"mohit.motiani@intel.com","username":"mohit.motiani"},"change_message_id":"5d3428ed903a4ab5bd51541f478173c0a7c0a3c8","unresolved":false,"context_lines":[{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"},{"line_number":12,"context_line":"(by default), then the login cookie URL will be the internal URL or IP."},{"line_number":13,"context_line":"So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to"},{"line_number":14,"context_line":"the public network, horizon leaks the values of the internal network IP"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_7b25f508","line":11,"updated":"2016-08-24 15:54:17.000000000","message":"Nit: s/internal/an internal","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"4ae0120354f29680fc55c5c53bc627101e55069b","unresolved":false,"context_lines":[{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"},{"line_number":12,"context_line":"(by default), then the login cookie URL will be the internal URL or IP."},{"line_number":13,"context_line":"So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to"},{"line_number":14,"context_line":"the public network, horizon leaks the values of the internal network IP"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_7e63d141","line":11,"in_reply_to":"1ac06dbe_7b25f508","updated":"2016-08-25 16:08:51.000000000","message":"+1","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"bb528f84f30d4c00c4141786c7328bd548b9bcfb","unresolved":false,"context_lines":[{"line_number":15,"context_line":"address."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Affected Services and Software ###"},{"line_number":18,"context_line":"Horizon"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Discussion ###"},{"line_number":21,"context_line":"This is not a bug in horizon, but a possible misconfiguration issue."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa7ab95a_3f255c08","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":7},"updated":"2016-08-29 21:31:19.000000000","message":"lower case for project names\nRefer http://docs.openstack.org/contributor-guide/writing-style.html","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"3f732a54808bd1aa6d7f718c26f92996cdf692af","unresolved":false,"context_lines":[{"line_number":15,"context_line":"address."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Affected Services and Software ###"},{"line_number":18,"context_line":"Horizon"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Discussion ###"},{"line_number":21,"context_line":"This is not a bug in horizon, but a possible misconfiguration issue."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa7ab95a_61adb083","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":7},"in_reply_to":"fa7ab95a_3f255c08","updated":"2016-09-01 17:42:08.000000000","message":"Done","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":20508,"name":"Mohit Motiani","email":"mohit.motiani@intel.com","username":"mohit.motiani"},"change_message_id":"5d3428ed903a4ab5bd51541f478173c0a7c0a3c8","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Horizon"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Discussion ###"},{"line_number":21,"context_line":"This is not a bug in horizon, but a possible misconfiguration issue."},{"line_number":22,"context_line":"Exposing the internal URL is not a bug, since one can view the internal"},{"line_number":23,"context_line":"URL as it\u0027s a freely accessible endpoint to authorized users, or"},{"line_number":24,"context_line":"it\u0027s hidden behind a firewall. Also, the data for internal URLs are"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_7b53356d","line":21,"updated":"2016-08-24 15:54:17.000000000","message":"s/horizon/the horizon","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"4ae0120354f29680fc55c5c53bc627101e55069b","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Horizon"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Discussion ###"},{"line_number":21,"context_line":"This is not a bug in horizon, but a possible misconfiguration issue."},{"line_number":22,"context_line":"Exposing the internal URL is not a bug, since one can view the internal"},{"line_number":23,"context_line":"URL as it\u0027s a freely accessible endpoint to authorized users, or"},{"line_number":24,"context_line":"it\u0027s hidden behind a firewall. Also, the data for internal URLs are"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_fe686123","line":21,"in_reply_to":"1ac06dbe_7b53356d","updated":"2016-08-25 16:08:51.000000000","message":"No need really, its a proper noun","commit_id":"c1913ff706b8537bbaa3d6bee731dca3fc0db3a0"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2069ed3e602b9f5e45faf3e9a1ef6b156db60c5f","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of"},{"line_number":6,"context_line":"the internal URL of keystone, as the default value for the identity"},{"line_number":7,"context_line":"service is \"internal URL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa7ab95a_192ffc88","line":7,"range":{"start_line":7,"start_character":12,"end_line":7,"end_character":24},"updated":"2016-09-01 18:56:44.000000000","message":"I think this should be internalURL (no space?)","commit_id":"ddbaaf0c039be8ee77e0c21122b16ede82366c2b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"7313be31457b2df044ceb1a51c478f78742398d5","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of"},{"line_number":6,"context_line":"the internal URL of keystone, as the default value for the identity"},{"line_number":7,"context_line":"service is \"internal URL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da7fb54a_245edc45","line":7,"range":{"start_line":7,"start_character":12,"end_line":7,"end_character":24},"in_reply_to":"fa7ab95a_192ffc88","updated":"2016-09-02 15:47:13.000000000","message":"Done","commit_id":"ddbaaf0c039be8ee77e0c21122b16ede82366c2b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2069ed3e602b9f5e45faf3e9a1ef6b156db60c5f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"service is \"internal URL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"},{"line_number":12,"context_line":"(by default), then the login cookie URL will be the internal URL or IP."},{"line_number":13,"context_line":"So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa7ab95a_f95fb80c","line":10,"range":{"start_line":10,"start_character":43,"end_line":10,"end_character":53},"updated":"2016-09-01 18:56:44.000000000","message":"publicURL?","commit_id":"ddbaaf0c039be8ee77e0c21122b16ede82366c2b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"7313be31457b2df044ceb1a51c478f78742398d5","unresolved":false,"context_lines":[{"line_number":7,"context_line":"service is \"internal URL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the public URL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"},{"line_number":12,"context_line":"(by default), then the login cookie URL will be the internal URL or IP."},{"line_number":13,"context_line":"So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da7fb54a_6458e457","line":10,"range":{"start_line":10,"start_character":43,"end_line":10,"end_character":53},"in_reply_to":"fa7ab95a_f95fb80c","updated":"2016-09-02 15:47:13.000000000","message":"Done","commit_id":"ddbaaf0c039be8ee77e0c21122b16ede82366c2b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2069ed3e602b9f5e45faf3e9a1ef6b156db60c5f","unresolved":false,"context_lines":[{"line_number":33,"context_line":"OpenStack Security ML : openstack-dev@lists.openstack.org"},{"line_number":34,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"  [1] : http://docs.openstack.org/developer/horizon/topics/settings.html"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa7ab95a_5c6412b8","line":36,"range":{"start_line":36,"start_character":0,"end_line":36,"end_character":6},"updated":"2016-09-01 18:56:44.000000000","message":"could you remove the spaces and shift to the left, like this:\n\n[1]: http://url\n\nMay as well use https as well.","commit_id":"ddbaaf0c039be8ee77e0c21122b16ede82366c2b"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"7313be31457b2df044ceb1a51c478f78742398d5","unresolved":false,"context_lines":[{"line_number":33,"context_line":"OpenStack Security ML : openstack-dev@lists.openstack.org"},{"line_number":34,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"  [1] : http://docs.openstack.org/developer/horizon/topics/settings.html"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da7fb54a_c43530f8","line":36,"range":{"start_line":36,"start_character":0,"end_line":36,"end_character":6},"in_reply_to":"fa7ab95a_5c6412b8","updated":"2016-09-02 15:47:13.000000000","message":"Done","commit_id":"ddbaaf0c039be8ee77e0c21122b16ede82366c2b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"9fb4f6dd24af7a2b179058e1ed7d5ee307e4778f","unresolved":false,"context_lines":[{"line_number":5,"context_line":"When horizon is configured, its URL contains the IP address of"},{"line_number":6,"context_line":"the internal URL of keystone, as the default value for the identity"},{"line_number":7,"context_line":"service is \"internalURL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the publicURL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"9a89bdaa_74433baf","line":8,"range":{"start_line":8,"start_character":0,"end_line":8,"end_character":1},"updated":"2016-09-08 17:58:59.000000000","message":"tiny nit: needs a carriage return","commit_id":"a31392e341faf1cfbd8453fdaa68e10adc068220"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"9fb4f6dd24af7a2b179058e1ed7d5ee307e4778f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"service is \"internalURL\".[1]"},{"line_number":8,"context_line":"The cookie \"login_region\" will be set to the value configured as"},{"line_number":9,"context_line":"OPENSTACK_KEYSTONE_URL, given in the local_settings.py file."},{"line_number":10,"context_line":"Usually, the OPENSTACK_KEYSTONE_URL is the publicURL, and hence"},{"line_number":11,"context_line":"the cookie URL will also be the public one. If set to internal URL"},{"line_number":12,"context_line":"(by default), then the login cookie URL will be the internal URL or IP."},{"line_number":13,"context_line":"So, by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"9a89bdaa_b41783a1","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":1},"updated":"2016-09-08 17:58:59.000000000","message":"tiny nit: needs a carriage return","commit_id":"a31392e341faf1cfbd8453fdaa68e10adc068220"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"9fb4f6dd24af7a2b179058e1ed7d5ee307e4778f","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Discussion ###"},{"line_number":21,"context_line":"This is not a bug in horizon, but a possible misconfiguration issue."},{"line_number":22,"context_line":"Exposing the internal URL is not a bug, since one can view the internal"},{"line_number":23,"context_line":"URL as it\u0027s a freely accessible endpoint to authorized users, or"},{"line_number":24,"context_line":"it\u0027s hidden behind a firewall. Also, the data for internal URLs are"},{"line_number":25,"context_line":"freely available in the catalog and the catalog is not considered"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"9a89bdaa_14290fe6","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":1},"updated":"2016-09-08 17:58:59.000000000","message":"tiny nit: needs a carriage return","commit_id":"a31392e341faf1cfbd8453fdaa68e10adc068220"}]}