Current Series Release Notes

18.0.0.0rc1-3

Security Issues

• Fixed two security flaws with the v2 API: any user could update/delete a lease from any project via the v2 API, provided that they had the lease ID. Additionally, any user could use the v2 API to list all leases, including those in another project. LP#2162719

  Operators that cannot yet upgrade should consider instead disabling the v2 API with the following config in blazar.conf:

  [api]
  api_v2_controllers =
  

Bug Fixes

• The resource property list API with detail=true now returns the actual private flag of each property. Previously it always returned false, even for private properties listed by an admin with all=true.