doc/source/conf.py | 1 0 + 1 - 0 !
1 file changed, 1 deletion(-)

 dont allow network access for building docs.

etc/glance-api.conf | 2 1 + 1 - 0 !
etc/glance-registry.conf | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 sets flavor=caching by default

etc/glance-api.conf | 2 1 + 1 - 0 !
etc/glance-registry.conf | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 fixes default connection in glance-registry.conf & glance-api.conf

glance/api/v1/images.py | 28 12 + 16 - 0 !
glance/store/__init__.py | 30 25 + 5 - 0 !
glance/tests/functional/v1/test_copy_to_file.py | 30 28 + 2 - 0 !
glance/tests/functional/v2/test_images.py | 160 69 + 91 - 0 !
glance/tests/unit/test_store_image.py | 3 2 + 1 - 0 !
glance/tests/unit/test_store_location.py | 33 27 + 6 - 0 !
glance/tests/unit/utils.py | 8 7 + 1 - 0 !
glance/tests/unit/v1/test_api.py | 60 59 + 1 - 0 !
8 files changed, 229 insertions(+), 123 deletions(-)

 to prevent client use v2 patch api to handle file and swift location
 The change will be used to restrict client to download and delete any file in
 glance-api server. The same resone and logic as what we did in v1:
 https://github.com/openstack/glance/blob/master/glance/api/v1/images.py#L429

glance/store/__init__.py | 11 7 + 4 - 0 !
glance/tests/unit/test_store_location.py | 3 3 + 0 - 0 !
glance/tests/unit/v1/test_api.py | 32 12 + 20 - 0 !
3 files changed, 22 insertions(+), 24 deletions(-)

 prevent file, swift+config and filesystem schemes
 This change ensures that 'file', 'filesystem', and 'swift+config' URI schemes
 are not allowed when setting the location field. A previous fix to
 CVE-2014-9493 attempted to address this issue but did not include
 'filesystem', a URI scheme allowed by the glance_store.
 .
 Without this fix in place it is possible for a client to access any file the
 glance-api server has read permissions for.

glance/api/authorization.py | 4 2 + 2 - 0 !
glance/api/policy.py | 8 4 + 4 - 0 !
glance/api/v1/upload_utils.py | 23 15 + 8 - 0 !
glance/api/v2/image_data.py | 18 11 + 7 - 0 !
glance/db/__init__.py | 7 4 + 3 - 0 !
glance/domain/proxy.py | 4 2 + 2 - 0 !
glance/notifier.py | 4 2 + 2 - 0 !
glance/quota/__init__.py | 4 2 + 2 - 0 !
glance/store/__init__.py | 2 1 + 1 - 0 !
glance/tests/unit/test_domain_proxy.py | 14 8 + 6 - 0 !
glance/tests/unit/test_policy.py | 2 1 + 1 - 0 !
glance/tests/unit/test_quota.py | 6 4 + 2 - 0 !
glance/tests/unit/test_store_image.py | 2 1 + 1 - 0 !
glance/tests/unit/v1/test_api.py | 51 24 + 27 - 0 !
glance/tests/unit/v2/test_image_data_resource.py | 24 14 + 10 - 0 !
15 files changed, 95 insertions(+), 78 deletions(-)

 cleanup chunks for deleted image that was 'saving'
 Currently image data cannot be removed synchronously for an image that
 is in saving state. And when, the upload operation for such an image is
 completed the operator configured quota can be exceeded.
 This patch fixes the issue of left over chunks for an image which was
 deleted from saving status. However, by the limitation of the design we
 cannot enforce a global quota check for the image in saving status.
 This change introduces a inconsonance between http response codes of
 v1 and v2 APIs. The status codes which we will now see after the upload
 process completes on an image which was deleted mid way are:
 .
  v1: 412 Precondition Failed
  v2: 410 Gone