Updated openstack/openstack
Project: openstack/horizon  1b0106e2804a45e641433c4bd459e6bed85521c3
null
Introduces escaping in Horizon/Orchestration

1) Escape help_text a second time to avoid bootstrap tooltip XSS issue

The "Description" parameter in a Heat template is used to populate
a help_text tooltip in the dynamically generated Heat form. Bootstrap
inserts this tooltip into the DOM using .html() which undoes any
escaping we do in Django (it should be using .text()).

This was fixed by forcing the help_text content to be escaped a second
time. The issue itself is mitigated in bootstrap.js release 2.0.3
(ours is currently 2.0.1).

2) Properly escape untrusted Heat template 'outputs'

The 'outputs' parameter in a Heat template was included in a Django
template with HTML autoescaping turned off. Malicious HTML content
could be included in a Heat template and would be rendered by Horizon
when details about a created stack were displayed.

This was fixed by not disabling autoescaping and explicitly escaping
untrusted values in any strings that are later marked "safe" to render
without further escaping.

Change-Id: Icd9f9d9ca77068b12227d77469773a325c840001
Closes-Bug: #1289033
Co-Authored-By: Kieran Spear <kispear@gmail.com>
Updated openstack/openstack
Project: openstack/ceilometer  cd13ec0f71c2745d8e740652ec4703962d491ba5
null
Allowed nested resource metadata in POST'd samples

Fixes bug 1302664

Previously, posting samples with nested metadata caused the mongo
driver to fail on the embedded period in a metadata key.

Now, we explicitly unwind the flattened resource metadata before
publishing the sample.

Change-Id: Ibb0980afc880218962328a9b7fe792015d58d1d2
(cherry picked from commit 2e8fa7c48fe4cca5674f895bd3985dc9243a9702)
Updated openstack/openstack
Project: openstack/oslo.messaging  c90581937c54c6abbeb2d5446440a6fb5913b0b3
null
Update ensure()/reconnect() to catch MessagingError

The error handling code that gets connections reset if necessary
caught ConnectionError.  It really needs to catch MessagingError,
which ConnectionError inherits from.  There are other types of
MessagingErrors that may occur, such as InternalError, and they need
to cause the connection to reset, as well.

Closes-bug: #1303890
Change-Id: Ic5082b74a362ded8b35cbc75cf178fe6e0db62d0