← Back to branch summary

~ubuntu-branches/ubuntu/saucy/nova/saucy-proposed

« back to all changes in this revision

Viewing changes to nova/api/openstack/wsgi.py

  • Committer: Package Import Robot
  • Author(s): Jamie Strandboge
  • Date: 2012-01-05 08:58:46 UTC
  • Revision ID: package-import@ubuntu.com-20120105085846-gtvbb26sr3r3v2mu
Tags: 2012.1~e2-0ubuntu4
https://launchpad.net/bugs/904072
* SECURITY UPDATE: fix tenant bypass by authenticated users via OpenStack
  API (LP: #904072)
  - CVE-2012-XXXX

Show diffs side-by-side

added added

removed removed

Lines of Context:
nova/api/openstack/wsgi.py
560
560
            return Fault(webob.exc.HTTPBadRequest(explanation=msg))
561
561
 
562
562
        project_id = args.pop("project_id", None)
563
 
        if 'nova.context' in request.environ and project_id:
564
 
            request.environ['nova.context'].project_id = project_id
 
563
        if ('nova.context' in request.environ and project_id
 
564
            and project_id != request.environ['nova.context'].project_id):
 
565
            msg = _("Malformed request url")
 
566
            return Fault(webob.exc.HTTPBadRequest(explanation=msg))
565
567
 
566
568
        try:
567
569
            action_result = self.dispatch(request, action, args)