add 'force' verification in _volume_upload_image

_volume_upload_image API should only support to upload 'in-use' volume to
image when assign 'force' parameter as true value. Now
_volume_upload_image API does not do verification for 'force' parameter,
so we can upload 'in-use' volume to image when assign 'force' parameter
with string value 'false' or 'false111'. This patch add verification for
'force' parameter.

Change-Id: I9e1d0e517d0ff97c136903dd6e50a305e18651f3
Closes-Bug: #1265718

diff --git a/cinder/api/contrib/volume_actions.py b/cinder/api/contrib/volume_actions.py
index 1e9cc529dbc852a40fcf862ffc3ed192ece2b383..ad18765d0b391b43833531c5b65526f516857c68 100644 (file)
--- a/cinder/api/contrib/volume_actions.py
+++ b/cinder/api/contrib/volume_actions.py
@@ -230,6 +230,16 @@ class VolumeActionsController(wsgi.Controller):
             raise webob.exc.HTTPBadRequest(explanation=msg)
 
         force = params.get('force', False)
+        if isinstance(force, basestring):
+            try:
+                force = strutils.bool_from_string(force, strict=False)
+            except ValueError:
+                msg = _("Bad value for 'force' parameter.")
+                raise webob.exc.HTTPBadRequest(explanation=msg)
+        elif not isinstance(force, bool):
+            msg = _("'force' is not string or bool.")
+            raise webob.exc.HTTPBadRequest(explanation=msg)
+
         try:
             volume = self.volume_api.get(context, id)
         except exception.VolumeNotFound as error: