gentoo-overlay/app-admin/glance/files/glance-folsom-3-CVE-2013-1840.patch

From dd849a9be540bedd4fd904cc0b86ccd9c3e34af2 Mon Sep 17 00:00:00 2001
From: Stuart McLaren <stuart.mclaren@hp.com>
Date: Thu, 14 Mar 2013 13:43:36 +0000
Subject: [PATCH] Do not return location in headers

In some cases credentials were being leaked when downloading a cached
v1 image.

Fixes bug 1135541, CVE-2013-1840

Change-Id: I3ec0a8f484fe1bdc32c3c56fce810fcef347a7f6
---
 glance/api/middleware/cache.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/glance/api/middleware/cache.py b/glance/api/middleware/cache.py
index 8e24ef0..dcd59b6 100644
--- a/glance/api/middleware/cache.py
+++ b/glance/api/middleware/cache.py
@@ -111,6 +111,9 @@ class CacheFilter(wsgi.Middleware):
 
     def _process_v1_request(self, request, image_id, image_iterator):
         image_meta = registry.get_image_metadata(request.context, image_id)
+        # Don't display location
+        if 'location' in image_meta:
+            del image_meta['location']
 
         if not image_meta['size']:
             # override image size metadata with the actual cached
-- 
1.8.1.5