Comment 4 for bug 1346648

Reviewed: https://review.openstack.org/146651
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=b159aa8b644338360f6e90d34af40a662246fe47
Submitter: Jenkins
Branch: master

commit b159aa8b644338360f6e90d34af40a662246fe47
Author: Ian Cordasco <email address hidden>
Date: Mon Jan 12 15:56:29 2015 -0600

    Pass a real image target to the policy enforcer

    Previously, every call to policy.enforce passed an empty dictionary as
    the target. This prevents operators from using tenant specific
    restrictions in their policy.json files since the target will always be
    an empty dictionary.

    If you try to restrict some actions so an image owner (users with the
    correct tenant id) can perform actions, the check categorically fails
    because the target is okay is an empty dictionary. By passing the
    ImageTarget instance wrapping an Image, we can properly grant access to
    the image owner(s) based on tenant (e.g., owner:%(tenant)). Without this
    fix, the only check that actually works in glance is a RoleCheck (e.g.,
    role:admin).

    Partial-bug: 1346648
    Implements: blueprint pass-targets-to-policy-enforcer
    Change-Id: Id914c478ca7c4dfde3f08028d8b70c623f26b6e9