diff --git a/glance/api/authorization.py b/glance/api/authorization.py
index aaf9ca098b..3a1045af53 100644
--- a/glance/api/authorization.py
+++ b/glance/api/authorization.py
@@ -14,6 +14,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import copy
+
 from glance.common import exception
 import glance.domain.proxy
 
@@ -222,6 +224,9 @@ class ImmutableLocations(list):
                     "for this image.")
         raise exception.Forbidden(message)
 
+    def __deepcopy__(self, memo):
+        return ImmutableLocations(copy.deepcopy(list(self), memo))
+
     append = forbidden
     extend = forbidden
     insert = forbidden
diff --git a/glance/tests/functional/v2/test_images.py b/glance/tests/functional/v2/test_images.py
index ed30d6da8f..a309e643ce 100644
--- a/glance/tests/functional/v2/test_images.py
+++ b/glance/tests/functional/v2/test_images.py
@@ -1845,7 +1845,8 @@ class TestImageDirectURLVisibility(functional.FunctionalTest):
         headers = self._headers({'content-type': 'application/json'})
         data = jsonutils.dumps({'name': 'image-1', 'type': 'kernel',
                                 'foo': 'bar', 'disk_format': 'aki',
-                                'container_format': 'aki'})
+                                'container_format': 'aki',
+                                'visibility': 'public'})
         response = requests.post(path, headers=headers, data=data)
         self.assertEqual(201, response.status_code)
 
@@ -1875,6 +1876,15 @@ class TestImageDirectURLVisibility(functional.FunctionalTest):
         image = jsonutils.loads(response.text)
         self.assertTrue('direct_url' in image)
 
+        # Image direct_url should be visible to non-owner, non-admin user
+        path = self._url('/v2/images/%s' % image_id)
+        headers = self._headers({'Content-Type': 'application/json',
+                                 'X-Tenant-Id': TENANT2})
+        response = requests.get(path, headers=headers)
+        self.assertEqual(200, response.status_code)
+        image = jsonutils.loads(response.text)
+        self.assertIn('direct_url', image)
+
         # Image direct_url should be visible in a list
         path = self._url('/v2/images')
         headers = self._headers({'Content-Type': 'application/json'})
diff --git a/glance/tests/unit/common/test_location_strategy.py b/glance/tests/unit/common/test_location_strategy.py
index 44a3db33cf..04f5bf5d1c 100644
--- a/glance/tests/unit/common/test_location_strategy.py
+++ b/glance/tests/unit/common/test_location_strategy.py
@@ -124,7 +124,7 @@ class TestLocationStrategy(base.IsolatedUnitTest):
         original_locs = [{'url': 'loc1'}, {'url': 'loc2'}]
         ordered_locs = location_strategy.get_ordered_locations(original_locs)
 
-        # Deep copy protect original location list.
+        # Original location list should remain unchanged
         self.assertNotEqual(id(original_locs), id(ordered_locs))
         self.assertEqual(original_locs, ordered_locs)