diff --git a/lib/galaxy/model/__init__.py b/lib/galaxy/model/__init__.py index 5dec2d1fba7..7bb3e052134 100644 --- a/lib/galaxy/model/__init__.py +++ b/lib/galaxy/model/__init__.py @@ -142,7 +142,6 @@ class JobToOutputDatasetAssociation( object ): self.dataset = dataset class Group( object ): - permitted_actions = get_permitted_actions( filter='GROUP' ) def __init__( self, name = None ): self.name = name self.deleted = False @@ -269,7 +268,7 @@ class LibraryFolderPermissions( object ): def __init__( self, action, library_item, role ): self.action = action if isinstance( library_item, LibraryFolder ): - self.library_folder = library_item + self.folder = library_item else: raise "Invalid LibraryFolder specified: %s" % library_item.__class__.__name__ self.role = role diff --git a/lib/galaxy/security/__init__.py b/lib/galaxy/security/__init__.py index 89d2d24b853..699712da81c 100644 --- a/lib/galaxy/security/__init__.py +++ b/lib/galaxy/security/__init__.py @@ -114,7 +114,18 @@ class GalaxyRBACAgent( RBACAgent ): allowed_role_assocs = [] for item_class, permission_class, info_association_class in self.library_item_assocs: if isinstance( library_item, item_class ): - allowed_role_assocs = permission_class.filter_by( action = action.action ).all() + if permission_class == self.model.LibraryPermissions: + allowed_role_assocs = permission_class.filter_by( action=action.action, library_id=library_item.id ).all() + elif permission_class == self.model.LibraryFolderPermissions: + allowed_role_assocs = permission_class.filter_by( action=action.action, library_folder_id=library_item.id ).all() + elif permission_class == self.model.LibraryDatasetPermissions: + allowed_role_assocs = permission_class.filter_by( action=action.action, library_dataset_id=library_item.id ).all() + elif permission_class == self.model.LibraryDatasetDatasetAssociationPermissions: + allowed_role_assocs = permission_class.filter_by( action=action.action, library_dataset_dataset_association_id=library_item.id ).all() + elif permission_class == self.model.LibraryItemInfoPermissions: + allowed_role_assocs = permission_class.filter_by( action=action.action, library_item_info_id=library_item.id ).all() + elif permission_class == self.model.LibraryItemInfoTemplatePermissions: + allowed_role_assocs = permission_class.filter_by( action=action.action, library_item_info_template_id=library_item.id ).all() for allowed_role_assoc in allowed_role_assocs: if allowed_role_assoc.role_id in user_role_ids: return True diff --git a/lib/galaxy/web/controllers/admin.py b/lib/galaxy/web/controllers/admin.py index 6d3c8c565b1..9d2b1e5b323 100644 --- a/lib/galaxy/web/controllers/admin.py +++ b/lib/galaxy/web/controllers/admin.py @@ -958,11 +958,11 @@ class Admin( BaseController ): action = 'update_roles' else: msg = "Invalid action attempted on folder." - return trans.response.send_redirect( web.url_for( action='library_browser', msg=util.sanitize_text( msg ), messagetype='error' ) ) + return trans.response.send_redirect( web.url_for( controller='admin', action='library_browser', msg=util.sanitize_text( msg ), messagetype='error' ) ) folder = trans.app.model.LibraryFolder.get( id ) if not folder: msg = "Invalid folder specified, id: %s" % str( id ) - return trans.response.send_redirect( web.url_for( action='library_browser', msg=util.sanitize_text( msg ), messagetype='error' ) ) + return trans.response.send_redirect( web.url_for( controller='admin', action='library_browser', msg=util.sanitize_text( msg ), messagetype='error' ) ) if action == 'new': if params.new == 'submitted': new_folder = trans.app.model.LibraryFolder( name=util.restore_text( params.name ), @@ -973,8 +973,11 @@ class Admin( BaseController ): new_folder.genome_build = util.dbnames.default_value folder.add_folder( new_folder ) new_folder.flush() - msg = "New folder named '%s' has been added to this library" % new_folder.name - return trans.response.send_redirect( web.url_for( action='folder', id=new_folder.id, msg=util.sanitize_text( msg ), messagetype='done' ) ) + msg = "New folder named '%s' has been added to the library" % new_folder.name + return trans.response.send_redirect( web.url_for( controller='admin', + action='library_browser', + msg=util.sanitize_text( msg ), + messagetype='done' ) ) return trans.fill_template( '/admin/library/new_folder.mako', folder=folder, msg=msg, messagetype=messagetype ) elif action == 'rename': if params.rename == 'submitted': @@ -989,7 +992,10 @@ class Admin( BaseController ): folder.description = new_description folder.flush() msg = "Folder '%s' has been renamed to '%s'" % ( old_name, new_name ) - return trans.response.send_redirect( web.url_for( action='library_browser', msg=util.sanitize_text( msg ), messagetype='done' ) ) + return trans.response.send_redirect( web.url_for( controller='admin', + action='library_browser', + msg=util.sanitize_text( msg ), + messagetype='done' ) ) return trans.fill_template( '/admin/library/rename_folder.mako', folder=folder, msg=msg, messagetype=messagetype ) elif action == 'delete': def delete_folder( folder ): @@ -1008,12 +1014,15 @@ class Admin( BaseController ): # The user clicked the Save button on the 'Associate With Roles' form permissions = {} for k, v in trans.app.model.Library.permitted_actions.items(): - in_roles = [ trans.app.model.Role.get( x ) for x in util.listify( kwd.get( k + '_in', [] ) ) ] + in_roles = [ trans.app.model.Role.get( int( x ) ) for x in util.listify( params.get( k + '_in', [] ) ) ] permissions[ trans.app.security_agent.get_action( v.action ) ] = in_roles trans.app.security_agent.set_all_library_permissions( folder, permissions ) folder.refresh() msg = "Permissions updated for folder '%s'" % folder.name - return trans.response.send_redirect( web.url_for( action='library_browser', msg=util.sanitize_text( msg ), messagetype='done' ) ) + return trans.response.send_redirect( web.url_for( controller='admin', + action='library_browser', + msg=util.sanitize_text( msg ), + messagetype='done' ) ) @web.expose @web.require_admin def library_dataset( self, trans, id=None, name=None, info=None, **kwd ): diff --git a/lib/galaxy/web/controllers/library.py b/lib/galaxy/web/controllers/library.py index 2ff7625e8d9..e1e424f4a58 100644 --- a/lib/galaxy/web/controllers/library.py +++ b/lib/galaxy/web/controllers/library.py @@ -14,7 +14,10 @@ log = logging.getLogger( __name__ ) class Library( BaseController ): @web.expose - def browse( self, trans, msg=None, messagetype=None, **kwd ): + def browse( self, trans, **kwd ): + params = util.Params( kwd ) + msg = util.restore_text( params.get( 'msg', '' ) ) + messagetype = params.get( 'messagetype', 'done' ) libraries = trans.app.model.Library.filter( trans.app.model.Library.table.c.deleted==False ) \ .order_by( trans.app.model.Library.table.c.name ).all() return trans.fill_template( '/library/browser.mako', @@ -315,59 +318,88 @@ class Library( BaseController ): msg=msg, messagetype=messagetype ) @web.expose - def folder( self, trans, folder_id, name=None, description=None, **kwd ): + def folder( self, trans, folder_id, **kwd ): params = util.Params( kwd ) msg = util.restore_text( params.get( 'msg', '' ) ) messagetype = params.get( 'messagetype', 'done' ) - if name: - name = util.restore_text( name ) - if description: - description = util.restore_text( description ) + if params.get( 'new', False ): + action = 'new' + elif params.get( 'rename', False ): + action = 'rename' + elif params.get( 'delete', False ): + action = 'delete' + elif params.get( 'update_roles', False ): + action = 'update_roles' + else: + msg = "Invalid action attempted on folder." + return trans.response.send_redirect( web.url_for( controller='library', action='browse', msg=util.sanitize_text( msg ), messagetype='error' ) ) folder = trans.app.model.LibraryFolder.get( int( folder_id ) ) if not folder: - msg = "Invalid library folder specified, id: %s" %str( id ) + msg = "Invalid folder specified, id: %s" %str( id ) return trans.response.send_redirect( web.url_for( controller='library', action='browse', msg=util.sanitize_text( msg ), messagetype='error' ) ) - if 'save' in kwd: - if trans.app.security_agent.allow_action( trans.user, - trans.app.security_agent.permitted_actions.LIBRARY_MODIFY, - library_item=folder ): - folder.name = name - folder.description = description - trans.app.model.flush() - msg = 'Attributes updated for library folder %s' % folder.name - else: - msg = "You are not authorized to modify this folder" - messagetype = "error" - elif 'update_roles' in kwd: + if action == 'new': + if params.new == 'submitted': + # Create the new folder, then return manage_folder template for new folder. + # New folders default to having the same permissions as their parent folder + new_folder = trans.app.model.LibraryFolder( name=util.restore_text( params.name ), + description=util.restore_text( params.description ) ) + new_folder.genome_build = util.dbnames.default_value + folder.add_folder( new_folder ) + new_folder.flush() + trans.app.security_agent.copy_library_permissions( folder, new_folder, user = trans.get_user() ) + folder = new_folder + msg = "New folder named '%s' has been added to the library" % new_folder.name + return trans.response.send_redirect( web.url_for( controller='library', + action='browse', + msg=util.sanitize_text( msg ), + messagetype='done' ) ) + return trans.fill_template( '/library/new_folder.mako', folder=folder, msg=msg, messagetype=messagetype ) + elif action == 'rename': + if params.rename == 'submitted': + if trans.app.security_agent.allow_action( trans.user, + trans.app.security_agent.permitted_actions.LIBRARY_MODIFY, + library_item=folder ): + old_name = folder.name + new_name = util.restore_text( params.name ) + new_description = util.restore_text( params.description ) + if not new_name: + msg = 'Enter a valid name' + return trans.fill_template( "/library/manage_folder.mako", folder=folder, msg=msg, messagetype='error' ) + else: + folder.name = new_name + folder.description = new_description + folder.flush() + msg = "Folder '%s' has been renamed to '%s'" % ( old_name, new_name ) + return trans.response.send_redirect( web.url_for( controller='library', + action='browse', + msg=util.sanitize_text( msg ), + messagetype='done' ) ) + else: + msg = "You are not authorized to rename this folder" + messagetype = "error" + elif action == 'update_roles': # The user clicked the Save button on the 'Associate With Roles' form if trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_MANAGE, library_item=folder ): permissions = {} for k, v in trans.app.model.Library.permitted_actions.items(): - in_roles = [ trans.app.model.Role.get( x ) for x in util.listify( kwd.get( k + '_in', [] ) ) ] + in_roles = [ trans.app.model.Role.get( int( x ) ) for x in util.listify( kwd.get( k + '_in', [] ) ) ] permissions[ trans.app.security_agent.get_action( v.action ) ] = in_roles trans.app.security_agent.set_all_library_permissions( folder, permissions ) folder.refresh() - msg = 'Permissions updated for library folder %s' % folder.name + msg = 'Permissions updated for folder %s' % folder.name + return trans.response.send_redirect( web.url_for( controller='library', + action='browse', + msg=util.sanitize_text( msg ), + messagetype='done' ) ) else: - msg = "You are not authorized to manage permissions on this library" - messagetype = "error" - elif 'create_new' in kwd: - # Create the new folder, then return manage_folder template for new folder. - # New folders default to having the same permissions as their parent folder - new_folder = trans.app.model.LibraryFolder( name = name, description = description ) - new_folder.flush() - folder.add_folder( new_folder ) - new_folder.flush() - trans.app.security_agent.copy_library_permissions( folder, new_folder, user = trans.get_user() ) - folder = new_folder - msg = "New folder (%s) created." % ( new_folder.name ) - return trans.fill_template( "/library/manage_folder.mako", - folder=folder, - err=None, - msg=msg, - messagetype=messagetype ) + msg = "You are not authorized to manage permissions on this folder" + return trans.response.send_redirect( web.url_for( controller='library', + action='browse', + msg=util.sanitize_text( msg ), + messagetype='error' ) ) + return trans.fill_template( "/library/manage_folder.mako", folder=folder, msg=msg, messagetype=messagetype ) @web.expose def edit_library( self, trans, id=None, **kwd ): raise Exception( 'Not yet implemented' ) diff --git a/templates/admin/library/rename_folder.mako b/templates/admin/library/rename_folder.mako index 9629c9ed278..b657d6e4f13 100644 --- a/templates/admin/library/rename_folder.mako +++ b/templates/admin/library/rename_folder.mako @@ -50,4 +50,4 @@ ${render_permission_form( folder, folder.name, h.url_for( action='folder' ), 'id', folder.id, roles )} -${render_available_templates( folder )} \ No newline at end of file +${render_available_templates( folder )} diff --git a/templates/library/browser.mako b/templates/library/browser.mako index 85a9017e82a..d3fa3d50200 100644 --- a/templates/library/browser.mako +++ b/templates/library/browser.mako @@ -110,6 +110,7 @@ def name_sorted( l ): def show_folder(): if trans.app.security_agent.check_folder_contents( trans.user, parent ) or trans.app.security_agent.show_library_item( trans.user, parent ): return True + return False if not show_folder: return "" pad = parent_pad + 20 @@ -121,6 +122,9 @@ def name_sorted( l ): expander = "/static/images/silk/resultset_next.png" folder = "/static/images/silk/folder.png" subfolder = True + add_folder_item = trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_ADD, library_item=parent ) + modify_folder = trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_MODIFY, library_item=parent ) + manage_folder = trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_MANAGE, library_item=parent ) %>
  • @@ -130,12 +134,23 @@ def name_sorted( l ): %if parent.description: - ${parent.description} %endif - -
    - %if trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_MANAGE, library_item=parent ): - Manage folder - %endif -
    + %if add_folder_item or modify_folder or manage_folder: + +
    + %endif + %if add_folder_item: + Add a new dataset to this folder + Create a new sub-folder in this folder + %endif + %if modify_folder: + Rename this folder + %endif + %if manage_folder: + Manage this folder + %endif + %if add_folder_item or modify_folder or manage_folder: +
    + %endif
    • %if subfolder: @@ -179,10 +194,11 @@ def name_sorted( l ): %if library.description: - ${library.description} %endif - %if trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_MODIFY, library_item=library ) or \ - trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_ADD, library_item=library ) or \ - trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_MANAGE, library_item=library ): + %if trans.app.security_agent.allow_action( trans.user, trans.app.security_agent.permitted_actions.LIBRARY_MANAGE, library_item=library ): +
    + Manage library +
    %endif @@ -192,9 +208,6 @@ def name_sorted( l ): -
    - Manage Library -