Juniper Openstack

  1. Bug #1400966
  2. Comment #20

Comment 20 for bug 1400966

Revision history for this message
Nikhil Komawar (nikhil-komawar) wrote : Re: Glance allows users to download and delete any file in glance-api server

The setting of policy to admin only makes sense.

However, there is a risk of backward incompatibility if a existing deployment runs with this assumption (and they knowingly change the policy in adherence to the security issue). Given the nature of the risk it (admin only policy) seems like a decent trade-off until a cleaner solution is proposed. We'd try to get the better fix sooner in kilo.

Thanks!