Update git submodules

* Update glance from branch 'master'
  to 429f16124b7cd69c85e6d764bcf1e47687780286
  - Remove dead 403->404 code
    
    The db.ImageRepo.save() operation covers up a Forbidden error with
    NotFound in the case of trying to update an image that the user does
    not own. This is actually never hit in reality as the authorization
    layer would have caught it before, and returned Forbidden. The API is
    the layer that should be deciding to hide images for which the user
    cannot see, to avoid things like being able to show an image, but get
    back a 404 on update. In order to do that, we need the lower layers to
    report the situation faithfully and let the upper layers decide how
    to expose that to the user.
    
    Specifically, for the policy refactor, we have tests that assert the
    Forbidden behavior, and after disabling the authorization layer, will
    break (and rightfully so) because they get NotFound when they hit the
    lower-layer check. Because it is hidden so deep, even the API can't
    distinguish between the two.
    
    I imagine this check was added long ago to provide the "if you can't
    see it, return NotFound instead of Forbidden, which would expose the
    fact that it exists" behavior which is desired. However, the
    authorization layer means we never get here anymore.
    
    This patch is provided without any test changes to prove that it does
    not actually alter the real behavior. The test_permissions functional
    test asserts the proper behavior before and after this change, as well
    as after subsequent refactor patches.
    
    Change-Id: I0084350ebb09cc1cb3752b45165e49f166bfdf91
This commit is contained in:
Dan Smith 2021-07-29 01:42:18 -07:00 committed by Gerrit Code Review
parent 9fd17ed2ab
commit 562a9647f8
1 changed files with 1 additions and 1 deletions

2
glance

@ -1 +1 @@
Subproject commit 2fef2e6c4f9fbbac795740ddfec57ba193029d03
Subproject commit 429f16124b7cd69c85e6d764bcf1e47687780286