From 76ab2cc064f9b4783f3330b9c54d2e6d068f4eef Mon Sep 17 00:00:00 2001 From: Martin Cech Date: Tue, 18 Oct 2022 13:48:21 -0700 Subject: [PATCH] use proper manager method for security check --- lib/galaxy/webapps/galaxy/api/workflows.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/galaxy/webapps/galaxy/api/workflows.py b/lib/galaxy/webapps/galaxy/api/workflows.py index 47ba804ef35..e824f17b5a9 100644 --- a/lib/galaxy/webapps/galaxy/api/workflows.py +++ b/lib/galaxy/webapps/galaxy/api/workflows.py @@ -1412,7 +1412,8 @@ class FastAPIWorkflows: trans: ProvidesUserContext = DependsOnTrans, workflow_id: DecodedDatabaseIdField = StoredWorkflowIDPathParam, ): - workflow_to_delete = self.workflows_manager.get_stored_workflow(trans, workflow_id, check_ownership=True) + workflow_to_delete = self.workflows_manager.get_stored_workflow(trans, workflow_id) + self.workflows_manager.check_security(trans, workflow_to_delete) self.workflows_manager.delete(workflow_to_delete) return Response(status_code=status.HTTP_204_NO_CONTENT) @@ -1425,7 +1426,8 @@ class FastAPIWorkflows: trans: ProvidesUserContext = DependsOnTrans, workflow_id: DecodedDatabaseIdField = StoredWorkflowIDPathParam, ): - workflow_to_undelete = self.workflows_manager.get_stored_workflow(trans, workflow_id, check_ownership=True) + workflow_to_undelete = self.workflows_manager.get_stored_workflow(trans, workflow_id) + self.workflows_manager.check_security(trans, workflow_to_undelete) self.workflows_manager.undelete(workflow_to_undelete) return Response(status_code=status.HTTP_204_NO_CONTENT)