CVE-2015-1881

@@ -84,29 +84,29 @@ def import_image(image_repo, image_factory, task_input, task_id, uri):
     # NOTE: set image status to saving just before setting data
     original_image.status = 'saving'
     image_repo.save(original_image)
-    set_image_data(original_image, uri, None)
-
-    # NOTE: Check if the Image is not deleted after setting the data
-    # before setting it's status to active. We need to set the status
-    # explicitly here using the Image object returned from image_repo .The
-    # Image object returned from create_image method does not have appropriate
-    # factories wrapped around it.
     image_id = original_image.image_id
+
+    # NOTE: Retrieving image from the database because the Image object
+    # returned from create_image method does not have appropriate factories
+    # wrapped around it.
     new_image = image_repo.get(image_id)
-    if new_image.status in ['saving']:
-        new_image.status = 'active'
-        new_image.size = original_image.size
-        new_image.virtual_size = original_image.virtual_size
-        new_image.checksum = original_image.checksum
+    set_image_data(new_image, uri, None)
+
+    # NOTE: Check if the Image is not deleted after setting the data
+    # before saving the active image. Here if image status is
+    # saving, then new_image is saved as it contains updated location,
+    # size, virtual_size and checksum information and the status of
+    # new_image is already set to active in set_image_data() call.
+    image = image_repo.get(image_id)
+    if image.status == 'saving':
+        image_repo.save(new_image)
+        return image_id
     else:
         msg = _LE("The Image %(image_id)s object being created by this task "
                   "%(task_id)s, is no longer in valid status for further "
                   "processing." % {"image_id": new_image.image_id,
                                    "task_id": task_id})
         raise exception.Conflict(msg)
-    image_repo.save(new_image)
-
-    return image_id
 
 
 def create_image(image_repo, image_factory, image_properties, task_id):

@@ -56,7 +56,8 @@ def test_import_image(self):
                     image_id,
                     image_import_script.import_image(image_repo, image_factory,
                                                      task_input, None, uri))
-                self.assertEqual('active', image.status)
+                # Check image is in saving state before image_repo.save called
+                self.assertEqual('saving', image.status)
                 self.assertTrue(image_repo.save.called)
                 mock_set_img_data.assert_called_once_with(image, uri, None)
                 self.assertTrue(image_repo.get.called)

@@ -86,37 +86,37 @@ def import_image(image_repo, image_factory, task_input, task_id, uri):
     # NOTE: set image status to saving just before setting data
     original_image.status = 'saving'
     image_repo.save(original_image)
-    set_image_data(original_image, uri, None)
-
-    # NOTE: Check if the Image is not deleted after setting the data
-    # before setting it's status to active. We need to set the status
-    # explicitly here using the Image object returned from image_repo .The
-    # Image object returned from create_image method does not have appropriate
-    # factories wrapped around it.
     image_id = original_image.image_id
+
+    # NOTE: Retrieving image from the database because the Image object
+    # returned from create_image method does not have appropriate factories
+    # wrapped around it.
+    new_image = image_repo.get(image_id)
+    set_image_data(new_image, uri, None)
+
     try:
-        new_image = image_repo.get(image_id)
-        if new_image.status == 'saving':
-            new_image.status = 'active'
-            new_image.size = original_image.size
-            new_image.virtual_size = original_image.virtual_size
-            new_image.checksum = original_image.checksum
+        # NOTE: Check if the Image is not deleted after setting the data
+        # before saving the active image. Here if image status is
+        # saving, then new_image is saved as it contains updated location,
+        # size, virtual_size and checksum information and the status of
+        # new_image is already set to active in set_image_data() call.
+        image = image_repo.get(image_id)
+        if image.status == 'saving':
+            image_repo.save(new_image)
+            return image_id
         else:
             msg = _("The Image %(image_id)s object being created by this task "
                     "%(task_id)s, is no longer in valid status for further "
-                    "processing.") % {"image_id": new_image.image_id,
+                    "processing.") % {"image_id": image_id,
                                       "task_id": task_id}
             raise exception.Conflict(msg)
-        image_repo.save(new_image)
-
-        return image_id
     except (exception.Conflict, exception.NotFound):
         with excutils.save_and_reraise_exception():
-            if original_image.locations:
-                for location in original_image.locations:
+            if new_image.locations:
+                for location in new_image.locations:
                     store_utils.delete_image_location_from_backend(
-                        original_image.context,
-                        original_image.image_id,
+                        new_image.context,
+                        image_id,
                         location)
 
 

@@ -56,7 +56,8 @@ def test_import_image(self):
                     image_id,
                     image_import_script.import_image(image_repo, image_factory,
                                                      task_input, None, uri))
-                self.assertEqual('active', image.status)
+                # Check image is in saving state before image_repo.save called
+                self.assertEqual('saving', image.status)
                 self.assertTrue(image_repo.save.called)
                 mock_set_img_data.assert_called_once_with(image, uri, None)
                 self.assertTrue(image_repo.get.called)