From 80e264d35ffbf9eecacf37918fab7f7dbfa27cc7 Mon Sep 17 00:00:00 2001 From: mvdbeek Date: Sat, 19 Aug 2017 14:43:59 +0200 Subject: [PATCH] Check ownership of invocation, instead of stored_workflow --- lib/galaxy/managers/workflows.py | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/lib/galaxy/managers/workflows.py b/lib/galaxy/managers/workflows.py index 4743d75996e..0f58e3f7b2e 100644 --- a/lib/galaxy/managers/workflows.py +++ b/lib/galaxy/managers/workflows.py @@ -167,18 +167,21 @@ class WorkflowsManager(object): return workflow_invocation_step def build_invocations_query(self, trans, decoded_stored_workflow_id): - try: - stored_workflow = trans.sa_session.query( - self.app.model.StoredWorkflow - ).get(decoded_stored_workflow_id) - except Exception: + """Get invocations owned by the current user.""" + stored_workflow = trans.sa_session.query( + self.app.model.StoredWorkflow + ).get(decoded_stored_workflow_id) + if not stored_workflow: raise exceptions.ObjectNotFound() - self.check_security(trans, stored_workflow, check_ownership=True, check_accessible=False) - return trans.sa_session.query( + invocations = trans.sa_session.query( model.WorkflowInvocation ).filter_by( workflow_id=stored_workflow.latest_workflow_id ) + return [inv for inv in invocations if self.check_security(trans, + inv, + check_ownership=True, + check_accessible=False)] CreatedWorkflow = namedtuple("CreatedWorkflow", ["stored_workflow", "workflow", "missing_tools"])