CVE-2012-5474: The file /etc/openstack-dashboard/local_settings is not world readable anymore (Closes: #693287)

Rewritten-From: e0a54a8ff5a8674ba634d6268f04903e5ed55eb3

Description: Fixes a Keyerror when displaying Instances & Volumes
 .
 bug 1053488 prevents the display of the Instances & Volumes page for
 every account with administrative permissions, once a volume has been
 created and attached to an instance. While there are workarounds (
 such as using an unprivileged account to display the same page ), it
 affects almost all admin users deploying the current release of
 horizon in Essex.
 .
 The source of the problem is that the relevant portion of code loops
 over all existing volumes while it only has access to the instances
 that are owned by the current tenant. As a consequence, it fails to
 find the instance to which a volume is attached when it does not
 belong to the current tenant.
 .
 A possible fix would be to change the behaviour of the volume list
 API so that it only returns the volumes of the current tenant even
 when the user has administrative rights. However, this would be a
 user visible change that may have side effects beyond the current
 bug.
 .
 The proposed patch catches the lookup error when the instance is not
 found for a given volume and creates a fake instance object which
 will only be used to display the name "UNKNOWN".
 .
 The associated test re-creates the conditions and derives from
 the class that will give administrative permissions to the test
 user. However, since the data is created from fixed data instead of
 being actually retrieved from the API, this derivation is only
 included to illustrate the purpose of the test.

Rewritten-From: 0ff59d489a66b6dc665cc25fb3a0beb7917e0cf4

Add the /static/horizon alias to the apache host definition. Without
    it the javascript files cannot be found and most of the dashboard
    functions are not working.

Rewritten-From: f7c609305db9aba85cdb9a260547df0bb6fdc8de

CVE-2012-3540: added patch: Disallow login redirects to anywhere other than the same origin (Closes: #686050)

Rewritten-From: 4a7ac06cd28ad3d9f92e2d987d0a1846a4de0743

Edited debian/changelog

Rewritten-From: 9e65c82967cb69f1121ddaaae10baab994c4a9a4

Add compression = xz to debian/gbp.conf

Rewritten-From: 27ee46d86ed4bb1f740b438569cd2d7b335b3064

Fixes debian/copyright URLs.

Rewritten-From: 1d069226ae8718fe87409da1fc0a123c936e5afc

Fixed depends field.

Rewritten-From: a564ea5d187fbbbb3582616c46facb527997a5f7

Added a get-vcs-source target in debian/rules

Rewritten-From: 74319a7c8a350c1c9255dab7395f1721deb1aa7c

Fixed missing license in debian/copyright

Rewritten-From: 2791621450baabe75ea0b54f5a9daf995c86cf08

Added missing (build-)dependencies

Rewritten-From: c72b6bad0008f3c9a4f2a85c5afa210a68b5b0b3

Add Loic Dachary to uploaders

Rewritten-From: fc79a2aabf2a2aad9140d4b36ce1d9f407d1c499

undo unannounced push that was commited after work start was advertised on #debian-openstack

Rewritten-From: b01d2cdd4ef28cf92e2e8b3455d330b45e3a5514

Don't listen on a new port by default

Rewritten-From: 32c6ca71f9c88d59377763d809fe536cb40930c8

Add /static alias (Closes: #679440)

Rewritten-From: 0d048797b9ad99575c373221829ca5dfc682c02b

Remove useless empty file

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: fa982d4bb9eb555b6d9d041e1ff004264c165f3d

Set correct release date

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 02b9e3cd02ee4756d48313532b25815d87a9dd60

Release

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: e752a028799eefcf058c7fb881d9f1d8479b4978

Fix clean target

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: bd19b97d7adfc4fd4ced86298d85c8f346fe5d6a

Say that is a new upstream release

Rewritten-From: f60d778e6bebc82cd631247a19927e4bed3966b4

Add Mehdi Abaakouk as Uploader

Rewritten-From: 45ff1383d6a572ec1a7c9e546de506e4312f767e

Clean horizon user home directory on purge. Closes: #668760

Rewritten-From: 6dfac1e841e93716cf02eedc5a0a7c0a49ac8e4c

Add gbp configuration file

Rewritten-From: 85dc72e499f5530a803a8b7c7374a4f6f72358e5

Remove patches fixed upstream: CVE_2012-2094, CVE_2012-2144

Rewritten-From: be4c9ee0e7fa4740ee48ed3ca8249aeabb1ae1a1

Remove useless dependency on openstackx

Rewritten-From: 1b3cab6f10b1ffa05498775c1309578ba7dccd5e

Fixed CVE_2012-2144. Closes: #671604

Rewritten-From: aad1f7ced2f6b5a40754f0d95a0d166e9e44403d

fix CVE_2012-2094

Rewritten-From: 4d2bcc69a337c0089b09c642afaf384c150b63d2

Typo

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 10efb8cf91d09856fba9a5173d4d0f4b2cf6552e

Make openstack-dashboard depends on the same version of python-django-horizon

Rewritten-From: 8d63702b602a9a7c9f56b737f16d05871932e272

New upstream release

Rewritten-From: 288cf0871bc70bd6e6efaacc431564e72209769e

New upstream release

Rewritten-From: 3fc07ce9926303ba7479b8f8b8e70b1a9616ff0c

Initial nginx support

Rewritten-From: e22eefaa0d37c92ead4b82343a4aecd3341981c2

New upstream release

Rewritten-From: 6aac0c9d8815910f650a284e85ca54b3b7c7db44

openstack-dashboard-apache depends on openstack-dashboard

Rewritten-From: e64a981fcf80a552c5464da335e840666f1ef675

Added python-iso8601 to depends. Closes: #663168

Rewritten-From: 44de87349388185535a193a744802f6e7c3c5551

Create horizon user/group and use it on apache wsgi

Rewritten-From: 1088d76799644ec67892bbb4bb2c00528da617e5

Removed pkg_data patch. Included upstream

Rewritten-From: 31d570922eefc73d8f9bcc5237ca4b40b2aa5ee9

New upstream release

Rewritten-From: aeed1c559ab49856d0c9683a0a499aff03aa6fcd

moved apache config to virtualhost:8080

Rewritten-From: 9c8ff5d721d297b91892ffe7c7ea093dd105bf79

Put apache conf inside a virtualhost

Rewritten-From: 379cd80311a92d39422748c37dce14b094a43c7e

Added files to git

Rewritten-From: e84b6616ad7a3e43fc24aeb1aa5724d997b32b1a

Fix apache conf file name

Rewritten-From: a9b081163eef8afae8ce735992633eea98e706ab

Initial apache2 support

Rewritten-From: 9197834f2dd05590b747ec12b1f6c9d036d956bb

Some final tweaking for pkg_data patch

Rewritten-From: c3ee0c1a0aea4cea6414e5e8de7d1fed43e62abc

Revert django-packages changes. Not ready yet

Rewritten-From: 8035a4357d383749b4b9a7986abf43219d372052

Added csv, template and mo files

Rewritten-From: 6ff9f1e63a5ca3dff7c143a7b907a647813eed83

Added .js to pkg_data patch

Rewritten-From: a945f679cc4f7df7a20c5f8acd7600a128d51d31

Fixed pkg_data

Rewritten-From: 7f79464cd2d29f592c62d46e87f861ae44677509

Added MANIFEST.in file to pkg_data patch

Rewritten-From: 8a09b1721ccb4535b2ee5b118c25738a491c29ee

Included pkg_data patch

Rewritten-From: ea59dd1a7d642aac5820ce637ac85bc370369dff

Merge branch 'debian/experimental' of git+ssh://git.debian.org/git/openstack/horizon into debian/experimental

Rewritten-From: 59335b11208ae82f86c83a19e3c0d6405f5ddacb

Updated apache conf to new directories

Rewritten-From: 42ed11e479e8516408c098bcb049cec70221a5d9

Updated apache conf to new directories

Rewritten-From: 33ac25ca9bbbb983b514e790d66d508bbd9b3a04

create apache2 dir

Rewritten-From: 3ecafb353bf0dc443d2f6c466d49a1f2ff9d2931

Initial apache2 support

Rewritten-From: c74412c5cd0b4b4e0dc9dc5db93f3b6232b2b06d

Added symlink to config files

Rewritten-From: e70e78bc947e2f64580c7b6c50909b54b9fc5702

Added local_settings.py file

Rewritten-From: f30dff40ff6524455dfdab4f99a2975a539b28b8

openstack-dashboards jquery no longer needed

Rewritten-From: 6109bda16e8b99dba4fc84538a7d145400c98ee7

fixed openstack-dashboard locations

Rewritten-From: edb3e5611a442d59ff1cb1b2d6a67e373dd1e49e

Copy new settings

Rewritten-From: 9635a6dab66367b62204ab715977da0d896d9a96

fix rules file. No more separate setup.py files

Rewritten-From: 092861292f6bbb55bf21a07e3027ddb0acf6bb04

Replaced quantum-client to python-quantunclient in Depends

Rewritten-From: a581faf178883a5a245cf39893719418822e447a

Added manage.py to openstack-dashboard pkg

Rewritten-From: dc8350404f4695278ab7100bdea9b9f5354128e3

Fixed typo in lib-jquery

Rewritten-From: a857bb7abb940176db2975890f2dfd7f03280870

New upstream release

Rewritten-From: 1c7ef12c7aa362803d4617ba049e47fed2866015

Merge branch 'debian/unstable' of git+ssh://git.debian.org/git/openstack/horizon into debian/unstable

Rewritten-From: 54b63c99f5597e6a4e4e27b949c74af8cac1dc6f

 Removes embedded jquery.js from openstack-dashboard

Rewritten-From: 4e71ec1300da0fa7ba5619fb2699eb97722c2c83

Rebuild to not depends on python-openstack-compute

Rewritten-From: 28711415f2935e35ab808dcf31e1b74c0cea1a03

New upstream release

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 9fee07e1fa290f0bb66382f9bc8c0dca33e22c13

Add forwarding URL to fix_django.wsgi_sys.path patch

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 370e49590541e4d71fb3bed31b2dc00d59f6e80a

Fix templates installation

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 51ef67edf9ca4cfff5d7b7fd24904b2838a3ff9b

Add missing dependency on python-dateutil

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 024c375355c0ccee4e0535e019bcf9cfcdf55cd4

Set remove_django_mailer patch URL

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 4dbea62f8f8ff82a76b4d38b8dc44ff376067b15

Add missing dependency on mox

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 418d4c67a50f06af31ebe5e1e7fe6d2b2b3f482e

Add a patch to remove django mailer dependency

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 53a045fe50fb0c4b288daffad617f2aa1c98aec9

Fix dependencies

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 3c1816cf29861011d01f6dbc88dd183f210674cd

Fix build-dependencies

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 8d4846d4a6cde9e1a8cd61babddf01ba04800ad1

Add missing dependency on python-cloudfiles

Rewritten-From: ca2616f14834d66a90d34f57378b2ab8d1df1e06

Add missing dependencies

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: a2a0910e019affa600bdc396abd22f7a64cfabc4

Store settings.py in /etc

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 86b4d9b2893646f57d2b4b1d20202eb40125fb5e

Store settings.py in /etc

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 085680d939a966d339433795ac4eed0416d5dfa9

Import Debian packaging

Signed-off-by: Julien Danjou <julien@danjou.info>
Rewritten-From: 63c37af215fe1ff5ca477394d0a1fb9a507bbb0c