v1 API returns 200 OK when an admin deletes a deleted image
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Glance |
Fix Released
|
Medium
|
Unmesh Gurjar | ||
Folsom |
Fix Released
|
Medium
|
Brian Waldon | ||
Grizzly |
Fix Released
|
Medium
|
Unmesh Gurjar | ||
glance (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Quantal |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
1. Delete an image in Glance
$ curl -v -H "X-Auth-
* About to connect() to 10.2.3.102 port 9292 (#0)
* Trying 10.2.3.102... connected
> DELETE /v1/images/
> User-Agent: curl/7.22.0 (x86_64-
> Host: 10.2.3.102:9292
> Accept: */*
> X-Auth-
> Content-type: application/json
>
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=UTF-8
< Content-Length: 4
< X-Openstack-
< Date: Wed, 03 Oct 2012 13:06:47 GMT
<
* Connection #0 to host 10.2.3.102 left intact
* Closing connection #0
Check image details:
-------
$ glance image-show e05f88fb-
+------
| Property | Value |
+------
| container_format | ovf |
| created_at | 2012-10-03T13:05:12 |
| deleted | True |
| deleted_at | 2012-10-03T13:06:47 |
| disk_format | raw |
| id | e05f88fb-
| is_public | False |
| min_disk | 0 |
| min_ram | 0 |
| name | demos_image |
| owner | b1519b1ea6b8439
| protected | False |
| size | 0 |
| status | deleted |
| updated_at | 2012-10-03T13:09:48 |
+------
2. Retry Deleting the image(as Admin):
k$ curl -v -H "X-Auth-
* About to connect() to 10.2.3.102 port 9292 (#0)
* Trying 10.2.3.102... connected
> DELETE /v1/images/
> User-Agent: curl/7.22.0 (x86_64-
> Host: 10.2.3.102:9292
> Accept: */*
> X-Auth-
> Content-type: application/json
>
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=UTF-8
< Content-Length: 4
< X-Openstack-
< Date: Wed, 03 Oct 2012 13:09:48 GMT
<
* Connection #0 to host 10.2.3.102 left intact
* Closing connection #0
### This should have returned 404 NotFound or an appropriate error.
Check image details again:
-------
$ glance image-show e05f88fb-
+------
| Property | Value |
+------
| container_format | ovf |
| created_at | 2012-10-03T13:05:12 |
| deleted | True |
| deleted_at | 2012-10-03T13:09:48 |
| disk_format | raw |
| id | e05f88fb-
| is_public | False |
| min_disk | 0 |
| min_ram | 0 |
| name | demos_image |
| owner | b1519b1ea6b8439
| protected | False |
| size | 0 |
| status | deleted |
| updated_at | 2012-10-03T13:09:48 |
+------
Note that the "deleted_at" timestamp gets updated after the second delete attempt.
This works fine for an non-admin context, but the behavior should for this scenario should be fixed for an admin context too.
Related branches
- Openstack Ubuntu Testers: Pending requested
-
Diff: 86 lines (+55/-2)2 files modifieddebian/changelog (+53/-1)
debian/control (+2/-1)
CVE References
Changed in glance: | |
assignee: | nobody → Unmesh Gurjar (unmesh-gurjar) |
Changed in glance: | |
importance: | Undecided → Medium |
Changed in glance: | |
milestone: | none → grizzly-1 |
status: | Fix Committed → Fix Released |
Changed in glance (Ubuntu): | |
status: | New → Fix Released |
Changed in glance (Ubuntu Quantal): | |
status: | New → Confirmed |
IMO, the API should return a 403 Forbidden error similar to the scenario where an admin updates a deleted image (https:/ /bugs.launchpad .net/glance/ +bug/1060930).