Introduces escaping in Horizon/Orchestration

1) Escape help_text a second time to avoid bootstrap tooltip XSS issue

The "Description" parameter in a Heat template is used to populate
a help_text tooltip in the dynamically generated Heat form. Bootstrap
inserts this tooltip into the DOM using .html() which undoes any
escaping we do in Django (it should be using .text()).

This was fixed by forcing the help_text content to be escaped a second
time. The issue itself is mitigated in bootstrap.js release 2.0.3
(ours is currently 2.0.1).

2) Properly escape untrusted Heat template 'outputs'

The 'outputs' parameter in a Heat template was included in a Django
template with HTML autoescaping turned off. Malicious HTML content
could be included in a Heat template and would be rendered by Horizon
when details about a created stack were displayed.

This was fixed by not disabling autoescaping and explicitly escaping
untrusted values in any strings that are later marked "safe" to render
without further escaping.

Change-Id: Icd9f9d9ca77068b12227d77469773a325c840001
Closes-Bug: #1289033
Co-Authored-By: Kieran Spear <kispear@gmail.com>
Opening stable/icehouse

Bump version to next stable release on icehouse branch, and set
defaultbranch in .gitreview for convenience.

Change-Id: I7e873a29ec26890e0ef21b97ec33feb78eadac5b
Add missing comma in Volume ResourceWrapper class

Change-Id: Ie0b0f40966f6bf98f693a971fdb498537842b21e
Closes-Bug: #1308642
(cherry picked from commit c45449c3a979c15ae414934fe162fbb4f0502ba0)
Check host is not none in host aggregate page

Check that host is not none before trying to parse
the services that are up in each availability zone

Change-Id: I757f35ca2fa84da3441b544280c1c430bf3e8fb8
Closes-Bug: #1297920
(cherry picked from commit 7f30ab5124618c5b11eebf9c6d69bcfd8a47adc3)
Merge "Add missing comma in Volume ResourceWrapper class" into stable/icehouse
Merge "Check host is not none in host aggregate page" into stable/icehouse
Add logging handler for openstack_auth in the tests

Without it, log output below ERROR level can also be displayed in the
tests output.

Change-Id: I342b20fc26468a41843496f11db3e0079b50505c
Closes-Bug: #1218462
(cherry picked from commit 8665768523f0afa057a485a7b0194c4b71e3a627)
Add missing mock for cinder.default_quota_get

When running tests, I get the following logs:

INFO:requests.packages.urllib3.connectionpool:Starting new HTTP connection (1):
public.nova.example.com

DEBUG:cinderclient.client:Connection refused:
HTTPConnectionPool(host='public.nova.example.com', port=8776): Max retries
exceeded with url: /v1/os-quota-sets/1/defaults (Caused by <class
'socket.gaierror'>: [Errno -2] Name or service not known)

Which signify, that there is a mock missing in the tests.
This patch adds that missing mock.

Change-Id: I4f79f533b729112d11c7165adde2ac751d49f46b
Closes-Bug: #1300141
(cherry picked from commit e019ed140e31f4a25b843429b70c3e28d48a8628)
Use escapejs filter on JavaScript strings

The escapejs filter will correctly escape single quotes from JavaScript
strings which may otherwise trigger syntax errors. In this case, the
issue was visible using the French translation.

Also removed a trailing paranthesis coming out of nowhere.

Change-Id: I25001815e17be5afa8eb28cc28c5423e3dcd973c
Closes-Bug: #1311047
(cherry picked from commit bc6f40b51d53682054cc4ba28b55b5045d6c8605)
add missing references to policy files

In local_settings.py.example, there were references
to policy files missing. When changing policy file
location, those are required.

Change-Id: I60e2271bb9d323f484524a448d28e40a5ace69b3
Closes-Bug: #1315739
(cherry picked from commit 8d020e9f771f912cb8e54344d6c6f278e53117cf)
Fix pseudo-folder content listing

Change-Id: Ib01eaea0493a294daed7032e6f9f82c2a0e8798a
Closes-Bug: #1312222
Closes-Bug: rhbz#1094783
(cherry picked from commit dceb2cc8d6f0f02e1f741d82097861a950cd951b)
Merge "Use escapejs filter on JavaScript strings" into stable/icehouse
Merge "add missing references to policy files" into stable/icehouse
Merge "Add logging handler for openstack_auth in the tests" into stable/icehouse
Updated from global requirements

Change-Id: I133c26e6e879a3dc407bc687005828fe4130043a
Fix the dot overlaps with the table border in Availability Zones table

Add space between the dot and table border in Availability
Zones table.

Change-Id: Ic4107c446b015eb72a54496a7a7ef6e2b0a53554
Closes-bug:#1309381
(cherry picked from commit 9456d69e02139c5cf891069a997ae03def0d242a)
Image uploads should always happen in the background

Sufficiently large image uploads into Glance from Horizon can cause
timeout errors, since the image upload needs to complete before the
view can render, and such activities can cause browser timeouts.
Since the webserver already has the file, and close-to-open semantics
should prevent cleanups from losing any data, just send it in a
background thread, the same way as if you told Horizon to fetch it
from a remote location.

Change-Id: Ia056367032e0d08edf6f36a8e9f900fddba85fdf
Closes-Bug: 1322399
Closes-Bug: 1325787
Merge "Fix the dot overlaps with the table border in Availability Zones table" into stable/icehouse
Fix formatting of heat exceptions

Heat now consistently formats error messages in returned HTTP json
and heatclient HTTPException makes every attempt to capture these
messages.

This means that the safest way to display an error or validation
message from Heat is to rely on the existing behaviour of
Horizon's exceptions.handle.

Change-Id: I80cdb67df87cb5192f220bc78a156d6e4113112f
Closes-Bug: #1241395
(cherry picked from commit 2c7db077b265c25573bfef73586a539fa639f65f)
Updated from global requirements

Change-Id: Iacd2e003769f832bdf9f287dd6c827fd0d8584a6