Merge tag '2013.2.1' of https://github.com/openstack/horizon into havana

2013.2.1
Merge remote-tracking branch 'upstream/stable/havana' into havana
Merge tag 'tags/2013.2.3' into havana

2013.2.3
Introduces escaping in Horizon/Orchestration

1) Escape help_text a second time to avoid bootstrap tooltip XSS issue

The "Description" parameter in a Heat template is used to populate
a help_text tooltip in the dynamically generated Heat form. Bootstrap
inserts this tooltip into the DOM using .html() which undoes any
escaping we do in Django (it should be using .text()).

This was fixed by forcing the help_text content to be escaped a second
time. The issue itself is mitigated in bootstrap.js release 2.0.3
(ours is currently 2.0.1).

2) Properly escape untrusted Heat template 'outputs'

The 'outputs' parameter in a Heat template was included in a Django
template with HTML autoescaping turned off. Malicious HTML content
could be included in a Heat template and would be rendered by Horizon
when details about a created stack were displayed.

This was fixed by not disabling autoescaping and explicitly escaping
untrusted values in any strings that are later marked "safe" to render
without further escaping.

Conflicts:
	openstack_dashboard/dashboards/project/stacks/mappings.py

Change-Id: Icd9f9d9ca77068b12227d77469773a325c840001
Closes-Bug: #1289033
Co-Authored-By: Kieran Spear <kispear@gmail.com>
(cherry picked from commit 54ec015f720a4379e8ffc34345b3a7bf36b6f15b)
Merge remote-tracking branch 'upstream/stable/havana' into havana
Replace UserManager with None in tests

Don't access keystoneclient's UserManager in tests. This should be
considered private data of keystoneclient and is not actually used by
horizon tests.

Conflicts:
	openstack_dashboard/test/test_data/keystone_data.py

Change-Id: I261e79b31dfc7388adb3dc63a3a5e54042f05e54
Closes-Bug: #1347236
(cherry picked from commit 821619fff324ba1bc3f697f585a0c350573f24a2)
(cherry picked from commit df782fc2b51f5e9d2e38e3e33a4ebdc0705a50b4)
Added precompiled Javascript files due to Horizon on SVL being configured to use offline compression

This patch is a forward-port of a patch from puppet-coe-service-patch
which had the following commit message:

---

    Revision: 538fa18143e273d68e99507df1222427ae87db06
    Author: Daniel Park <daniepar@cisco.com>
    Date: 7/23/2014 5:23:50 PM

    DE610 - Added precompiled Javascript files due to Horizon on SVL being configured to use offline compression

    Change-Id: Ic3b474f5b014fd825a6883640e025147da5df39c

---

Implements: rally-user-story US4145
Implements: rally-task TA3483
Not-in-upstream: true
Merge pull request #4 from CiscoSystems/TA3483/df782fc2b51

Replace UserManager with None in tests
Merge pull request #6 from CiscoSystems/TA3483/538fa18143

Added precompiled Javascript files due to Horizon on SVL being configured to use offline compression
Sanitized drag-and-drop names to prevent XSS

This patch is a forward-port of a patch from puppet-coe-service-patch
which had the following commit message:

---

    Revision: e682666e1d928b61e3f87927edd96ffa695ff344
    Author: Daniel Park <daniepar@cisco.com>
    Date: 7/22/2014 12:12:59 PM
    Message:
    DE610 - Sanitized drag-and-drop names to prevent XSS

    https://us1.rallydev.com/#/20103531125d/detail/defect/20692523466

    Chained a few more .replace() calls to properly santize drag-and-drop names for launching Horizon instances and creating firewall names.
    Also added escaping for email addresses. Please refer to the following bugs for more details:

    [OSSA 2014-023] Stored XSS for /admin/users/ (CVE-2014-3475):
    https://bugs.launchpad.net/horizon/+bug/1320235

    [OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474):
    https://bugs.launchpad.net/horizon/+bug/1322197

    [OSSA 2014-023] XSS in Horizon Heat template - resource name (CVE-2014-3473):
    https://bugs.launchpad.net/horizon/+bug/1308727

    Based on https://review.openstack.org/#/c/105478/

    Change-Id: I03546278f2309615393dbe005c09ecd6629452f5

---

Implements: rally-user-story US4145
Implements: rally-task TA3483
Not-in-upstream: true
Fix multiple Cross-Site Scripting (XSS) vulnerabilities

 * Ensure user emails are properly escaped

User emails in the Users and Groups panel are being passed through the
urlize filter to transform them into clickable links. However, urlize
expects input to be already escaped and safe. We should make sure to
escape the strings first as email addresses are not validated and can
contain any type of string.

Closes-Bug: #1320235

 * Ensure network names are properly escaped in the Launch Instance menu

Closes-Bug: #1322197

 * Escape the URLs generated for the Horizon tables

When generating the Horizon tables, there was an assumption that only
the anchor text needed to be escaped. However some URLs are generated
based on user-provided data and should be escaped as well. Also escape
the link attributes for good measure.

 * Use 'reverse' to generate the Resource URLs in the stacks tables

Closes-Bug: #1308727

Conflicts:
	horizon/tables/base.py
	openstack_dashboard/dashboards/admin/users/tables.py

Change-Id: Ic8a92e69f66c2d265a802f350e30f091181aa42e

Conflicts:
	horizon/static/horizon/js/horizon.instances.js
	horizon/tables/base.py
	openstack_dashboard/dashboards/admin/groups/tables.py
	openstack_dashboard/dashboards/admin/users/tables.py
	openstack_dashboard/dashboards/project/stacks/tabs.py
Sanitized drag-and-drop names to prevent XSS

This patch is a forward-port of a patch from puppet-coe-service-patch
which had the following commit message:

---

    Revision: e682666e1d928b61e3f87927edd96ffa695ff344
    Author: Daniel Park <daniepar@cisco.com>
    Date: 7/22/2014 12:12:59 PM
    Message:
    DE610 - Sanitized drag-and-drop names to prevent XSS

    https://us1.rallydev.com/#/20103531125d/detail/defect/20692523466

    Chained a few more .replace() calls to properly santize drag-and-drop names for launching
    Horizon instances and creating firewall names.
    Also added escaping for email addresses. Please refer to the following bugs for more details:

    [OSSA 2014-023] Stored XSS for /admin/users/ (CVE-2014-3475):
    https://bugs.launchpad.net/horizon/+bug/1320235

    [OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474):
    https://bugs.launchpad.net/horizon/+bug/1322197

    [OSSA 2014-023] XSS in Horizon Heat template - resource name (CVE-2014-3473):
    https://bugs.launchpad.net/horizon/+bug/1308727

    Based on https://review.openstack.org/#/c/105478/    (commit c844bd)

    Change-Id: I03546278f2309615393dbe005c09ecd6629452f5

---

Implements: rally-user-story US4145
Implements: rally-task TA3483
Not-in-upstream: true
Overriding lbaas.py file

This patch is a forward-port of a patch from puppet-coe-service-patch
which had the following commit message:

---

Revision: 4ee88b7361bc378b2f2dc6828d69838d914dd18a
Author: Ernest Millan <emillan@cisco.com>
Date: 7/9/2014 12:36:12 PM

    Overriding lbaas.py file and related puppet manifest update for TA2342
    Change-Id: Ifddb4036de15aad50a5ace0693fe297412cc389c

    "The current Horizon Load Balancer VIP input requires a user to input an IP
    address for the VIP on the subnet that the Load Balancer Pool is on.  From
    the CLI or API the neutron lb-vip-create takes a --subnet-id argument.  We
    need an enhancement so that user does not have to manually type in an IP
    from the subnet. Furthermore the neutron lp-pool has a param for subnet-id
    and the VIP gets associated to a pool as an optional param, or from Horizon
    you actually Add Vip under the LB Pool tab which inherently should already
    know what the subnet is. This is an unnecessary hardship for clients and
    prone to race conditions especially on shared networks."

---

Implements: rally-user-story US4145
Implements: rally-task TA3483
Not-in-upstream: true
Merge pull request #7 from CiscoSystems/TA3483/e682666e1d

Sanitized drag-and-drop names to prevent XSS
Merge pull request #8 from CiscoSystems/TA3483/4ee88b7361

Overriding lbaas.py file
Remove "Resize Instance" link from instances.

Apparently it is unsupported by the back-end systems but Havana has no
simple option to disable it via policies.

Partial-rally-bug: DE571
Not-in-upstream: true
Remove "Resize Instance" link from instances.

Apparently it is unsupported by the back-end systems but Havana has no
simple option to disable it via policies.  The link can be disabled
with a policy in Icehouse so this is just a temporary workaround.

Partial-rally-bug: DE571
Not-in-upstream: true
Merge branch 'bug/DE571' of github.com:ameoba/horizon into bug/DE571
Merge pull request #9 from ameoba/bug/DE571

Remove "Resize Instance" link from instances.
Merge remote-tracking branch 'os/stable/havana' into cis-havana-staging

Conflicts:
	horizon/static/horizon/js/horizon.instances.js
	horizon/tables/base.py
	openstack_dashboard/dashboards/admin/groups/tables.py
	openstack_dashboard/dashboards/admin/users/tables.py
	openstack_dashboard/dashboards/project/stacks/tabs.py