Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐛 Check view_my_version permissions for downloads #459

Merged
merged 1 commit into from
Aug 27, 2020
Merged

🐛 Check view_my_version permissions for downloads #459

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 19 additions & 9 deletions creator/files/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,19 +66,29 @@ def download(request, study_id, file_id, version_id=None):
except DevDownloadToken.DoesNotExist:
dev_token = None

if (
not user.is_authenticated or not user.has_perm("files.view_file")
) and (
download_token is None and dev_token is None
): # There is no valid dev token
return HttpResponse("Not authorized to download the file", status=401)

try:
file, obj = _resolve_version(file_id, version_id)
except File.DoesNotExist:
return HttpResponseNotFound('No file exists with given ID')
return HttpResponseNotFound("No file exists with given ID")
except Version.DoesNotExist:
return HttpResponseNotFound('No version exists with given ID')
return HttpResponseNotFound("No version exists with given ID")

# Check that the user is allowed to download the file
if not (
user.is_authenticated
and ( # User does not have permissions
user.has_perm("files.view_version")
or (
user.has_perm("files.view_my_version")
and user.studies.filter(
kf_id=obj.root_file.study.kf_id
).exists()
)
)
) and ( # There are no valid tokens
download_token is None and dev_token is None
):
return HttpResponse("Not authorized to download the file", status=401)

# Don't return anything if the file does not belong to the requested study
if file.study.kf_id != study_id:
Expand Down