Merge pull request #18217 from mvdbeek/tighten_job_access

[24.0] Restrict job_files access to jobs that are not terminal
galaxyproject · May 24, 2024 · 21a4272 · 21a4272
2 parents 7ab7475 + 4e47b8d
commit 21a4272
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/lib/galaxy/webapps/galaxy/api/job_files.py b/lib/galaxy/webapps/galaxy/api/job_files.py
@@ -182,7 +182,7 @@ def __authorize_job_access(self, trans, encoded_job_id, **kwargs):
 
         # Verify job is active. Don't update the contents of complete jobs.
         job = trans.sa_session.get(Job, job_id)
-        if job.finished:
+        if job.state not in Job.non_ready_states:
             error_message = "Attempting to read or modify the files of a job that has already completed."
             raise exceptions.ItemAccessibilityException(error_message)
         return job

diff --git a/lib/galaxy/webapps/galaxy/api/job_tokens.py b/lib/galaxy/webapps/galaxy/api/job_tokens.py
@@ -64,7 +64,7 @@ def __authorize_job_access(self, trans, encoded_job_id, job_key):
 
         # Verify job is active
         job = session.get(Job, job_id)
-        if job.finished:
+        if job.state not in Job.non_ready_states:
             error_message = "Attempting to get oidc token for a job that has already completed."
             raise exceptions.ItemAccessibilityException(error_message)
         return job