Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[23.1] Only check access permissions in /api/{history_dataset_collection_id}/contents/{dataset_collection_id} #17459

Merged
merged 3 commits into from
Feb 13, 2024
Merged

[23.1] Only check access permissions in /api/{history_dataset_collection_id}/contents/{dataset_collection_id} #17459

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8c3d967
fix published history collections are empty on expand
ahmedhamidawan Feb 8, 2024
4eab971
remove `check_ownership` from `dataset_collections.contents`
ahmedhamidawan Feb 9, 2024
d18003e
add api test for hdcas in public histories being accessible
ahmedhamidawan Feb 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/galaxy/webapps/galaxy/services/dataset_collections.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,7 +250,7 @@ def contents(
"Parameter instance_type not being 'history' is not yet implemented."
)
hdca: "HistoryDatasetCollectionAssociation" = self.collection_manager.get_dataset_collection_instance(
trans, "history", hdca_id, check_ownership=True
trans, "history", hdca_id
)

# check to make sure the dsc is part of the validated hdca
Expand Down
12 changes: 12 additions & 0 deletions lib/galaxy_test/api/test_dataset_collections.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,6 +418,18 @@ def test_collection_contents_security(self, history_id):
contents_response = self._get(contents_url)
self._assert_status_code_is(contents_response, 403)

@requires_new_user
def test_published_collection_contents_accessible(self, history_id):
# request contents on an hdca that is in a published history
hdca, contents_url = self._create_collection_contents_pair(history_id)
with self._different_user():
contents_response = self._get(contents_url)
self._assert_status_code_is(contents_response, 403)
self.dataset_populator.make_public(history_id)
with self._different_user():
contents_response = self._get(contents_url)
self._assert_status_code_is(contents_response, 200)

def test_collection_contents_invalid_collection(self, history_id):
# request an invalid collection from a valid hdca, should get 404
hdca, contents_url = self._create_collection_contents_pair(history_id)
Expand Down
Loading