Do not overwrite project_id from request params

Prevent project_id overwriting from OSAPI request parameters.
The patch is actually very simple (nova/api/openstack/wsgi.py) but
needs significant test adjustments (nova/tests/*) to pass.

Fixes bug 904072. Patch from Vish Ishaya and Mark McLoughlin.

(cherry picked from commit c9c09bd)

Change-Id: I66ea0f178ce6271ec1020e9f1a73bd4e8c83ddab

nova/api/openstack/wsgi.py

@@ -487,8 +487,10 @@ def __call__(self, request):
             return faults.Fault(webob.exc.HTTPBadRequest(explanation=msg))
 
         project_id = args.pop("project_id", None)
-        if 'nova.context' in request.environ and project_id:
-            request.environ['nova.context'].project_id = project_id
+        if ('nova.context' in request.environ and project_id
+            and project_id != request.environ['nova.context'].project_id):
+            msg = _("Malformed request url")
+            return faults.Fault(webob.exc.HTTPBadRequest(explanation=msg))
 
         try:
             action_result = self.dispatch(request, action, args)

nova/tests/api/openstack/contrib/test_createserverext.py

@@ -165,7 +165,7 @@ def _create_user_data_request_dict(self, user_data):
         return {'server': server}
 
     def _get_create_request_json(self, body_dict):
-        req = webob.Request.blank('/v1.1/123/os-create-server-ext')
+        req = webob.Request.blank('/v1.1/fake/os-create-server-ext')
         req.headers['Content-Type'] = 'application/json'
         req.method = 'POST'
         req.body = json.dumps(body_dict)
@@ -209,7 +209,7 @@ def _format_xml_request_body(self, body_dict):
         return ''.join(body_parts)
 
     def _get_create_request_xml(self, body_dict):
-        req = webob.Request.blank('/v1.1/123/os-create-server-ext')
+        req = webob.Request.blank('/v1.1/fake/os-create-server-ext')
         req.content_type = 'application/xml'
         req.accept = 'application/xml'
         req.method = 'POST'
@@ -392,7 +392,7 @@ def test_create_instance_with_security_group_json(self):
 
     def test_get_server_by_id_verify_security_groups_json(self):
         self.stubs.Set(nova.db.api, 'instance_get', return_server_by_id)
-        req = webob.Request.blank('/v1.1/123/os-create-server-ext/1')
+        req = webob.Request.blank('/v1.1/fake/os-create-server-ext/1')
         req.headers['Content-Type'] = 'application/json'
         response = req.get_response(fakes.wsgi_app())
         self.assertEquals(response.status_int, 200)
@@ -403,7 +403,7 @@ def test_get_server_by_id_verify_security_groups_json(self):
 
     def test_get_server_by_id_verify_security_groups_xml(self):
         self.stubs.Set(nova.db.api, 'instance_get', return_server_by_id)
-        req = webob.Request.blank('/v1.1/123/os-create-server-ext/1')
+        req = webob.Request.blank('/v1.1/fake/os-create-server-ext/1')
         req.headers['Accept'] = 'application/xml'
         response = req.get_response(fakes.wsgi_app())
         self.assertEquals(response.status_int, 200)

nova/tests/api/openstack/contrib/test_floating_ips.py

@@ -147,7 +147,7 @@ def test_translate_floating_ip_view_dict(self):
         self.assertTrue('floating_ip' in view)
 
     def test_floating_ips_list(self):
-        req = webob.Request.blank('/v1.1/123/os-floating-ips')
+        req = webob.Request.blank('/v1.1/fake/os-floating-ips')
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 200)
         res_dict = json.loads(res.body)
@@ -162,7 +162,7 @@ def test_floating_ips_list(self):
         self.assertEqual(res_dict, response)
 
     def test_floating_ip_show(self):
-        req = webob.Request.blank('/v1.1/123/os-floating-ips/1')
+        req = webob.Request.blank('/v1.1/fake/os-floating-ips/1')
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 200)
         res_dict = json.loads(res.body)
@@ -176,7 +176,7 @@ def get_floating_ip(self, context, id):
                     'fixed_ip': {'address': '10.0.0.1', 'instance_id': 1}}
         self.stubs.Set(network.api.API, "get_floating_ip", get_floating_ip)
 
-        req = webob.Request.blank('/v1.1/123/os-floating-ips/1')
+        req = webob.Request.blank('/v1.1/fake/os-floating-ips/1')
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 200)
         res_dict = json.loads(res.body)
@@ -189,7 +189,7 @@ def fake_call(*args, **kwargs):
             raise(rpc.RemoteError('NoMoreFloatingIps', '', ''))
 
         self.stubs.Set(rpc, "call", fake_call)
-        req = webob.Request.blank('/v1.1/123/os-floating-ips')
+        req = webob.Request.blank('/v1.1/fake/os-floating-ips')
         req.method = 'POST'
         req.headers['Content-Type'] = 'application/json'
         res = req.get_response(fakes.wsgi_app())
@@ -198,7 +198,7 @@ def fake_call(*args, **kwargs):
     def test_floating_ip_allocate(self):
         self.stubs.Set(network.api.API, "allocate_floating_ip",
                        network_api_allocate)
-        req = webob.Request.blank('/v1.1/123/os-floating-ips')
+        req = webob.Request.blank('/v1.1/fake/os-floating-ips')
         req.method = 'POST'
         req.headers['Content-Type'] = 'application/json'
         res = req.get_response(fakes.wsgi_app())
@@ -226,7 +226,7 @@ def disassociate(ignore, context, floating_address):
                        get_floating_ip)
         self.stubs.Set(network.api.API, "disassociate_floating_ip",
                        disassociate)
-        req = webob.Request.blank('/v1.1/123/os-floating-ips/1')
+        req = webob.Request.blank('/v1.1/fake/os-floating-ips/1')
         req.method = 'DELETE'
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 202)
@@ -246,7 +246,7 @@ def fake_disassociate(ignore, context, floating_address):
                        fake_get_floating_ip)
         self.stubs.Set(network.api.API, "disassociate_floating_ip",
                        fake_disassociate)
-        req = webob.Request.blank('/v1.1/123/os-floating-ips/1')
+        req = webob.Request.blank('/v1.1/fake/os-floating-ips/1')
         req.method = 'DELETE'
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 202)
@@ -256,7 +256,7 @@ def test_add_floating_ip_to_instance(self):
         self.stubs.Set(network.api.API, "associate_floating_ip",
                        network_api_associate)
         body = dict(addFloatingIp=dict(address='11.0.0.1'))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -273,7 +273,7 @@ def fake_fixed_ip_get_by_address(ctx, address, session=None):
         db.floating_ip_update(self.context, self.address, {'project_id': 'bad',
                                                            'fixed_ip_id': 1})
         body = dict(addFloatingIp=dict(address=self.address))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -289,7 +289,7 @@ def fake_fixed_ip_get_by_address(ctx, address, session=None):
         db.floating_ip_update(self.context, self.address, {'project_id': None,
                                                            'fixed_ip_id': 1})
         body = dict(addFloatingIp=dict(address=self.address))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -306,15 +306,15 @@ def fake_fixed_ip_get_by_address(ctx, address, session=None):
         def fake_network_api_disassociate(local_self, ctx, floating_address):
             self.disassociated = True
 
-        db.floating_ip_update(self.context, self.address, {'project_id': '123',
-                                                           'fixed_ip_id': 1})
+        db.floating_ip_update(self.context, self.address,
+                              {'project_id': 'fake', 'fixed_ip_id': 1})
         self.stubs.Set(network.api.API, "disassociate_floating_ip",
                        fake_network_api_disassociate)
         self.stubs.Set(db.api, "fixed_ip_get_by_address",
                        fake_fixed_ip_get_by_address)
 
         body = dict(addFloatingIp=dict(address=self.address))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -338,7 +338,7 @@ def fake_disassociate(ignore, context, floating_address):
         self.stubs.Set(network.api.API, "disassociate_floating_ip",
                        fake_disassociate)
         body = dict(removeFloatingIp=dict(address='10.10.10.10'))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -362,7 +362,7 @@ def fake_disassociate(ignore, context, floating_address):
         self.stubs.Set(network.api.API, "disassociate_floating_ip",
                        fake_disassociate)
         body = dict(removeFloatingIp=dict(address='10.10.10.10'))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -373,7 +373,7 @@ def fake_disassociate(ignore, context, floating_address):
 
     def test_bad_address_param_in_remove_floating_ip(self):
         body = dict(removeFloatingIp=dict(badparam='11.0.0.1'))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -383,7 +383,7 @@ def test_bad_address_param_in_remove_floating_ip(self):
 
     def test_missing_dict_param_in_remove_floating_ip(self):
         body = dict(removeFloatingIp='11.0.0.1')
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -393,7 +393,7 @@ def test_missing_dict_param_in_remove_floating_ip(self):
 
     def test_bad_address_param_in_add_floating_ip(self):
         body = dict(addFloatingIp=dict(badparam='11.0.0.1'))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -403,7 +403,7 @@ def test_bad_address_param_in_add_floating_ip(self):
 
     def test_missing_dict_param_in_add_floating_ip(self):
         body = dict(addFloatingIp='11.0.0.1')
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"

nova/tests/api/openstack/contrib/test_keypairs.py

@@ -58,7 +58,7 @@ def setUp(self):
         self.context = context.get_admin_context()
 
     def test_keypair_list(self):
-        req = webob.Request.blank('/v1.1/123/os-keypairs')
+        req = webob.Request.blank('/v1.1/fake/os-keypairs')
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 200)
         res_dict = json.loads(res.body)
@@ -67,7 +67,7 @@ def test_keypair_list(self):
 
     def test_keypair_create(self):
         body = {'keypair': {'name': 'create_test'}}
-        req = webob.Request.blank('/v1.1/123/os-keypairs')
+        req = webob.Request.blank('/v1.1/fake/os-keypairs')
         req.method = 'POST'
         req.body = json.dumps(body)
         req.headers['Content-Type'] = 'application/json'
@@ -93,7 +93,7 @@ def test_keypair_import(self):
             },
         }
 
-        req = webob.Request.blank('/v1.1/123/os-keypairs')
+        req = webob.Request.blank('/v1.1/fake/os-keypairs')
         req.method = 'POST'
         req.body = json.dumps(body)
         req.headers['Content-Type'] = 'application/json'
@@ -105,7 +105,7 @@ def test_keypair_import(self):
         self.assertFalse('private_key' in res_dict['keypair'])
 
     def test_keypair_delete(self):
-        req = webob.Request.blank('/v1.1/123/os-keypairs/FAKE')
+        req = webob.Request.blank('/v1.1/fake/os-keypairs/FAKE')
         req.method = 'DELETE'
         req.headers['Content-Type'] = 'application/json'
         res = req.get_response(fakes.wsgi_app())

nova/tests/api/openstack/contrib/test_multinic_xs.py

@@ -55,7 +55,7 @@ def test_add_fixed_ip(self):
         last_add_fixed_ip = (None, None)
 
         body = dict(addFixedIp=dict(networkId='test_net'))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = 'POST'
         req.body = json.dumps(body)
         req.headers['content-type'] = 'application/json'
@@ -69,7 +69,7 @@ def test_add_fixed_ip_no_network(self):
         last_add_fixed_ip = (None, None)
 
         body = dict(addFixedIp=dict())
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = 'POST'
         req.body = json.dumps(body)
         req.headers['content-type'] = 'application/json'
@@ -83,7 +83,7 @@ def test_remove_fixed_ip(self):
         last_remove_fixed_ip = (None, None)
 
         body = dict(removeFixedIp=dict(address='10.10.10.1'))
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = 'POST'
         req.body = json.dumps(body)
         req.headers['content-type'] = 'application/json'
@@ -97,7 +97,7 @@ def test_remove_fixed_ip_no_address(self):
         last_remove_fixed_ip = (None, None)
 
         body = dict(removeFixedIp=dict())
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = 'POST'
         req.body = json.dumps(body)
         req.headers['content-type'] = 'application/json'

nova/tests/api/openstack/contrib/test_quotas.py

@@ -78,7 +78,7 @@ def test_format_quota_set(self):
         self.assertEqual(qs['injected_file_content_bytes'], 10240)
 
     def test_quotas_defaults(self):
-        uri = '/v1.1/fake_tenant/os-quota-sets/fake_tenant/defaults'
+        uri = '/v1.1/fake/os-quota-sets/fake_tenant/defaults'
         req = webob.Request.blank(uri)
         req.method = 'GET'
         req.headers['Content-Type'] = 'application/json'
@@ -100,7 +100,7 @@ def test_quotas_defaults(self):
         self.assertEqual(json.loads(res.body), expected)
 
     def test_quotas_show_as_admin(self):
-        req = webob.Request.blank('/v1.1/1234/os-quota-sets/1234')
+        req = webob.Request.blank('/v1.1/fake/os-quota-sets/1234')
         req.method = 'GET'
         req.headers['Content-Type'] = 'application/json'
         res = req.get_response(fakes.wsgi_app(
@@ -125,7 +125,7 @@ def test_quotas_update_as_admin(self):
                              'metadata_items': 128, 'injected_files': 5,
                              'injected_file_content_bytes': 10240}}
 
-        req = webob.Request.blank('/v1.1/1234/os-quota-sets/update_me')
+        req = webob.Request.blank('/v1.1/fake/os-quota-sets/update_me')
         req.method = 'PUT'
         req.body = json.dumps(updated_quota_set)
         req.headers['Content-Type'] = 'application/json'
@@ -142,7 +142,7 @@ def test_quotas_update_as_user(self):
                              'metadata_items': 128, 'injected_files': 5,
                              'injected_file_content_bytes': 10240}}
 
-        req = webob.Request.blank('/v1.1/1234/os-quota-sets/update_me')
+        req = webob.Request.blank('/v1.1/fake/os-quota-sets/update_me')
         req.method = 'PUT'
         req.body = json.dumps(updated_quota_set)
         req.headers['Content-Type'] = 'application/json'

nova/tests/api/openstack/contrib/test_rescue.py

@@ -36,7 +36,7 @@ def setUp(self):
 
     def test_rescue(self):
         body = dict(rescue=None)
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"
@@ -46,7 +46,7 @@ def test_rescue(self):
 
     def test_unrescue(self):
         body = dict(unrescue=None)
-        req = webob.Request.blank('/v1.1/123/servers/test_inst/action')
+        req = webob.Request.blank('/v1.1/fake/servers/test_inst/action')
         req.method = "POST"
         req.body = json.dumps(body)
         req.headers["content-type"] = "application/json"