If you put up a FASTA file, and try to get prep info, you get a 500

[wasade]

Traceback (most recent call last):
  File "/Users/mcdonadt/miniconda3/envs/qiita/lib/python2.7/site-packages/tornado/web.py", line 1141, in _when_complete
    callback()
  File "/Users/mcdonadt/miniconda3/envs/qiita/lib/python2.7/site-packages/tornado/web.py", line 1162, in _execute_method
    self._when_complete(method(*self.path_args, **self.path_kwargs),
  File "/Users/mcdonadt/miniconda3/envs/qiita/lib/python2.7/site-packages/tornado/web.py", line 2297, in wrapper
    return method(self, *args, **kwargs)
  File "/Users/mcdonadt/ResearchWork/software/qiita/qiita_core/util.py", line 121, in wrapper
    return func(*args, **kwargs)
  File "/Users/mcdonadt/ResearchWork/software/qiita/qiita_pet/handlers/download.py", line 18, in get
    if not validate_filepath_access_by_user(self.current_user, fid):
  File "/Users/mcdonadt/ResearchWork/software/qiita/qiita_db/meta_util.py", line 128, in validate_filepath_access_by_user
    if (a.visibility == 'public' or a.study.has_access(user)):
AttributeError: 'NoneType' object has no attribute 'visibility'
ERROR:tornado.access:500 GET /download/28 (::1) 121.62ms

[antgonza]

This is part of this issue: #953. Summarizing, we used to allow just fna (without quals) without processing but we decided that we will fully stop that support.

[wasade]

The user is reporting the issue arises when selecting other datatypes too and I can confirm locally. See the screenshot -- if I click on "Prep info" I get a 500 error.

[josenavas]

I think the actual error here is triggered when hitting "prep_info". If there is no artifact attached to the preparation (as it is according to the image) the check for access to the file fails. The issue is actually on the download code.

[antgonza]

Got it and excellent point. Download assumes that the prep has an artifact and "shares" the visibility of that artifact to the prep. IMOO we should allow download of these files to only admins, the owner and invited guests if the artifact doesn't exist. @wasade and @josenavas, do you agree? If so, I can fix.

[josenavas]

yes, only people that have access to the study, which are admins, owners and shared. Thanks!

[wasade]

seems reasonable