opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-09-24 16:30:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

Security fixes for the library_common controller.

Browse Source
This commit is contained in:
Nate Coraor
2010-06-21 11:15:13 -04:00
parent 0a473b66f9
commit b7119df159
16 changed files with 1194 additions and 700 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/model/__init__.py
+6
View File
@@ -961,6 +961,12 @@ class LibraryFolder( object ):
if isinstance( name, str ):
name = unicode( name, 'utf-8' )
return name
@property
def parent_library( self ):
f = self
while f.parent:
f = f.parent
return f.library_root[0]
class LibraryDataset( object ):
# This class acts as a proxy to the currently selected LDDA
lib/galaxy/security/__init__.py
+27 -3
View File
@@ -220,10 +220,19 @@ class GalaxyRBACAgent( RBACAgent ):
if not item_actions:
return action.model == 'restrict'
ret_val = False
for item_action in item_actions:
if item_action.role in roles:
# For DATASET_ACCESS only, user must have ALL associated roles
if action == self.permitted_actions.DATASET_ACCESS:
for item_action in item_actions:
if item_action.role not in roles:
break
else:
ret_val = True
break
# For remaining actions, user must have any associated role
else:
for item_action in item_actions:
if item_action.role in roles:
ret_val = True
break
return ret_val
def can_access_dataset( self, roles, dataset ):
return self.dataset_is_public( dataset ) or self.allow_action( roles, self.permitted_actions.DATASET_ACCESS, dataset )
@@ -231,6 +240,18 @@ class GalaxyRBACAgent( RBACAgent ):
return self.allow_action( roles, self.permitted_actions.DATASET_MANAGE_PERMISSIONS, dataset )
def can_access_library( self, roles, library ):
return self.library_is_public( library ) or self.allow_action( roles, self.permitted_actions.LIBRARY_ACCESS, library )
def can_access_library_item( self, roles, item, user ):
if type( item ) == self.model.Library:
return self.can_access_library( roles, item )
elif type( item ) == self.model.LibraryFolder:
return self.can_access_library( roles, item.parent_library ) and self.check_folder_contents( user, roles, item )[0]
elif type( item ) == self.model.LibraryDataset:
return self.can_acess_library( roles, item.folder.parent_library ) and self.can_access_dataset( roles, item.library_dataset_dataset_association.dataset )
elif type( item ) == self.model.LibraryDatasetDatasetAssociation:
return self.can_access_library( roles, item.library_dataset.folder.parent_library ) and self.can_access_dataset( roles, item.dataset )
else:
log.warning( 'Unknown library item type: %s' % type ( item ) )
return False
def can_add_library_item( self, roles, item ):
return self.allow_action( roles, self.permitted_actions.LIBRARY_ADD, item )
def can_modify_library_item( self, roles, item ):
@@ -732,6 +753,9 @@ class GalaxyRBACAgent( RBACAgent ):
This method does not necessarily scan the entire library as it returns when it finds the first
folder that is accessible to user.
"""
# If a folder is writeable, it's accessable and we need not go further
if self.can_add_library_item( roles, folder ):
return True, ''
action = self.permitted_actions.DATASET_ACCESS
lddas = self.sa_session.query( self.model.LibraryDatasetDatasetAssociation ) \
.join( "library_dataset" ) \
lib/galaxy/web/controllers/library_common.py
+1052 -614
View File
File diff suppressed because it is too large Load Diff
templates/library/common/browse_library.mako
+57 -43
View File
@@ -178,9 +178,13 @@
uploaded_by = 'anonymous'
if ldda == library_dataset.library_dataset_dataset_association:
current_version = True
if cntrller in [ 'library', 'requests' ]:
if trans.user_is_admin() and cntrller == 'library_admin':
can_modify = can_manage = True
elif cntrller in [ 'library', 'requests' ]:
can_modify = trans.app.security_agent.can_modify_library_item( current_user_roles, library_dataset )
can_manage = trans.app.security_agent.can_manage_library_item( current_user_roles, library_dataset )
else:
can_modify = can_manage = False
else:
current_version = False
if current_version and ldda.state not in ( 'ok', 'error', 'empty', 'deleted', 'discarded' ):
@@ -210,29 +214,29 @@
%endif
%if not library.deleted:
<div popupmenu="dataset-${ldda.id}-popup">
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ( cntrller == 'library_admin' or can_modify ):
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify:
<a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a>
%else:
<a class="action-button" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">View information</a>
%endif
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ( ( cntrller == 'library_admin' or can_modify ) and not info_association ):
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ( can_modify and not info_association ):
<a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='ldda', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), ldda_id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add template</a>
%endif
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ( ( cntrller == 'library_admin' or can_modify ) and info_association ):
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ( can_modify and info_association ):
<a class="action-button" href="${h.url_for( controller='library_common', action='edit_template', cntrller=cntrller, item_type='ldda', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), ldda_id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit template</a>
<a class="action-button" href="${h.url_for( controller='library_common', action='delete_template', cntrller=cntrller, item_type='ldda', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), ldda_id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Delete template</a>
%endif
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ( cntrller == 'library_admin' or can_manage ):
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_manage:
<a class="action-button" href="${h.url_for( controller='library_common', action='ldda_permissions', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit permissions</a>
%endif
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ( cntrller == 'library_admin' or can_modify ):
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify:
<a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), replace_id=trans.security.encode_id( library_dataset.id ), show_deleted=show_deleted )}">Upload a new version of this dataset</a>
%endif
%if not branch_deleted( folder ) and not ldda.library_dataset.deleted and ldda.has_data:
<a class="action-button" href="${h.url_for( controller='library_common', action='act_on_multiple_datasets', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), ldda_ids=trans.security.encode_id( ldda.id ), do_action='import_to_history', use_panels=use_panels, show_deleted=show_deleted )}">Import this dataset into your current history</a>
<a class="action-button" href="${h.url_for( controller='library_common', action='download_dataset_from_folder', cntrller=cntrller, id=trans.security.encode_id( ldda.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels )}">Download this dataset</a>
%endif
%if cntrller == 'library_admin' or can_modify:
%if can_modify:
%if not library.deleted and not branch_deleted( folder ) and not ldda.library_dataset.deleted:
<a class="action-button" confirm="Click OK to delete dataset '${ldda.name}'." href="${h.url_for( controller='library_common', action='delete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( library_dataset.id ), item_type='library_dataset', show_deleted=show_deleted )}">Delete this dataset</a>
%elif not library.deleted and not branch_deleted( folder ) and not ldda.library_dataset.purged and ldda.library_dataset.deleted:
@@ -271,7 +275,9 @@
if str( folder.id ) in hidden_folder_ids:
return ""
my_row = None
if cntrller in [ 'library', 'requests' ]:
if trans.user_is_admin() and cntrller == 'library_admin':
can_add = can_modify = can_manage = True
elif cntrller in [ 'library', 'requests' ]:
can_access, folder_ids = trans.app.security_agent.check_folder_contents( trans.user, current_user_roles, folder )
if not can_access:
can_show, folder_ids = \
@@ -286,6 +292,8 @@
can_add = trans.app.security_agent.can_add_library_item( current_user_roles, folder )
can_modify = trans.app.security_agent.can_modify_library_item( current_user_roles, folder )
can_manage = trans.app.security_agent.can_manage_library_item( current_user_roles, folder )
else:
can_add = can_modify = can_manage = False
info_association, inherited = folder.get_info_association( restrict=True )
%>
%if not root_folder and ( not folder.deleted or show_deleted ):
@@ -311,33 +319,35 @@
%if folder.deleted:
</span>
%endif
%if not library.deleted:
<div popupmenu="folder_img-${folder.id}-popup">
%if not branch_deleted( folder ) and ( cntrller == 'library_admin' or can_add ):
<a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a>
<a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a>
%endif
%if not branch_deleted( folder ) and ( cntrller == 'library_admin' or can_modify ):
<a class="action-button" href="${h.url_for( controller='library_common', action='folder_info', cntrller=cntrller, id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a>
%endif
%if not branch_deleted( folder ) and ( ( cntrller == 'library_admin' or can_modify ) and not info_association ):
<a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='folder', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add template</a>
%endif
%if not branch_deleted( folder ) and ( ( cntrller == 'library_admin' or can_modify ) and info_association ):
<a class="action-button" href="${h.url_for( controller='library_common', action='edit_template', cntrller=cntrller, item_type='folder', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit template</a>
<a class="action-button" href="${h.url_for( controller='library_common', action='delete_template', cntrller=cntrller, item_type='folder', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Delete template</a>
%endif
%if not branch_deleted( folder ) and ( cntrller == 'library_admin' or can_manage ):
<a class="action-button" href="${h.url_for( controller='library_common', action='folder_permissions', cntrller=cntrller, id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit permissions</a>
%endif
%if cntrller == 'library_admin' or can_modify:
%if not library.deleted and not folder.deleted:
<a class="action-button" confirm="Click OK to delete the folder '${folder.name}.'" href="${h.url_for( controller='library_common', action='delete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( folder.id ), item_type='folder', show_deleted=show_deleted )}">Delete this folder</a>
%elif not library.deleted and folder.deleted and not folder.purged:
<a class="action-button" href="${h.url_for( controller='library_common', action='undelete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( folder.id ), item_type='folder', show_deleted=show_deleted )}">Undelete this folder</a>
%if not branch_deleted( folder ) and ( can_add or can_modify or can_manage ):
%if not library.deleted:
<div popupmenu="folder_img-${folder.id}-popup">
%if not branch_deleted( folder ) and can_add:
<a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a>
<a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a>
%endif
%endif
</div>
%if not branch_deleted( folder ) and can_modify:
<a class="action-button" href="${h.url_for( controller='library_common', action='folder_info', cntrller=cntrller, id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a>
%endif
%if not branch_deleted( folder ) and ( can_modify and not info_association ):
<a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='folder', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add template</a>
%endif
%if not branch_deleted( folder ) and ( can_modify and info_association ):
<a class="action-button" href="${h.url_for( controller='library_common', action='edit_template', cntrller=cntrller, item_type='folder', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit template</a>
<a class="action-button" href="${h.url_for( controller='library_common', action='delete_template', cntrller=cntrller, item_type='folder', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Delete template</a>
%endif
%if not branch_deleted( folder ) and can_manage:
<a class="action-button" href="${h.url_for( controller='library_common', action='folder_permissions', cntrller=cntrller, id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit permissions</a>
%endif
%if can_modify:
%if not library.deleted and not folder.deleted:
<a class="action-button" confirm="Click OK to delete the folder '${folder.name}.'" href="${h.url_for( controller='library_common', action='delete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( folder.id ), item_type='folder', show_deleted=show_deleted )}">Delete this folder</a>
%elif not library.deleted and folder.deleted and not folder.purged:
<a class="action-button" href="${h.url_for( controller='library_common', action='undelete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( folder.id ), item_type='folder', show_deleted=show_deleted )}">Undelete this folder</a>
%endif
%endif
</div>
%endif
%endif
</div>
<td colspan="5"></td>
@@ -362,7 +372,7 @@
${render_dataset( cntrller, ldda, library_dataset, selected, library, folder, pad, my_row, row_counter, tracked_datasets, show_deleted=show_deleted )}
%endif
%endfor
%elif cntrller == 'library_admin':
%elif trans.user_is_admin() and cntrller == 'library_admin':
<%
if show_deleted:
sub_folders, lddas = activatable_folders_and_lddas( trans, folder )
@@ -388,10 +398,14 @@
from galaxy.web.controllers.library_common import branch_deleted
from time import strftime
if cntrller in [ 'library', 'requests' ]:
if trans.user_is_admin() and cntrller == 'library_admin':
can_add = can_modify = can_manage = True
elif cntrller in [ 'library', 'requests' ]:
can_add = trans.app.security_agent.can_add_library_item( current_user_roles, library )
can_modify = trans.app.security_agent.can_modify_library_item( current_user_roles, library )
can_manage = trans.app.security_agent.can_manage_library_item( current_user_roles, library )
else:
can_add = can_modify = can_manage = False
info_association, inherited = library.get_info_association()
tracked_datasets = {}
@@ -408,14 +422,14 @@
<h2>Data Library &ldquo;${library.name}&rdquo;</h2>
<ul class="manage-table-actions">
%if not library.deleted and ( cntrller in [ 'library_admin', 'requests_admin' ] or can_add ):
%if not library.deleted and ( ( trans.user_is_admin() and cntrller == 'requests_admin' ) or can_add ):
<li><a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( library.root_folder.id ), use_panels=use_panels, show_deleted=show_deleted )}"><span>Add datasets</span></a></li>
<li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li>
%endif
<li><a class="action-button" id="library-${library.id}-popup" class="menubutton">Library Actions</a></li>
<div popupmenu="library-${library.id}-popup">
%if not library.deleted:
%if cntrller == 'library_admin' or can_modify:
%if can_modify:
<a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a>
<a class="action-button" confirm="Click OK to delete the library named '${library.name}'." href="${h.url_for( controller='library_common', action='delete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( library.id ), item_type='library' )}">Delete this data library</a>
%if show_deleted:
@@ -424,17 +438,17 @@
<a class="action-button" href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=True )}">Show deleted items</a>
%endif
%endif
%if ( cntrller == 'library_admin' or can_modify ) and not library.info_association:
%if can_modify and not library.info_association:
<a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add template</a>
%endif
%if ( cntrller == 'library_admin' or can_modify ) and info_association:
%if can_modify and info_association:
<a class="action-button" href="${h.url_for( controller='library_common', action='edit_template', cntrller=cntrller, item_type='library', library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit template</a>
<a class="action-button" href="${h.url_for( controller='library_common', action='delete_template', cntrller=cntrller, item_type='library', library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Delete template</a>
%endif
%if cntrller == 'library_admin' or can_manage:
%if can_manage:
<a class="action-button" href="${h.url_for( controller='library_common', action='library_permissions', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit permissions</a>
%endif
%elif ( cntrller == 'library_admin' or can_modify ) and not library.purged:
%elif can_modify and not library.purged:
<a class="action-button" href="${h.url_for( controller='library_common', action='undelete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( library.id ), item_type='library', use_panels=use_panels )}">Undelete this data library</a>
%elif library.purged:
<a class="action-button" href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">This data library has been purged</a>
@@ -470,7 +484,7 @@
%if not library.deleted:
${render_actions_on_multiple_items()}
%endif
%elif cntrller in [ 'library_admin', 'requests_admin' ]:
%elif ( trans.user_is_admin() and cntrller in [ 'library_admin', 'requests_admin' ] ):
${self.render_folder( 'library_admin', library.root_folder, 0, created_ldda_ids, library, [], tracked_datasets, show_deleted=show_deleted, parent=None, row_counter=row_counter, root_folder=True )}
%if not library.deleted and not show_deleted:
${render_actions_on_multiple_items()}
templates/library/common/common.mako
+11 -8
View File
@@ -6,12 +6,15 @@
item = trans.sa_session.query( trans.app.model.LibraryFolder ).get( trans.security.decode_id( folder_id ) )
elif item_type == 'ldda':
item = trans.sa_session.query( trans.app.model.LibraryDatasetDatasetAssociation ).get( trans.security.decode_id( ldda_id ) )
if cntrller == 'library':
current_user_roles = trans.get_current_user_roles()
can_modify = trans.app.security_agent.can_modify_library_item( current_user_roles, item )
if trans.user_is_admin() and cntrller == 'library_admin':
can_modify = True
elif cntrller == 'library':
can_modify = trans.app.security_agent.can_modify_library_item( trans.get_current_user_roles(), item )
else:
can_modify = False
%>
%if widgets:
%if editable and ( cntrller=='library_admin' or trans.app.security_agent.can_modify_library_item( current_user_roles, item ) ):
%if editable and can_modify:
<p/>
<div class="toolForm">
<div class="toolFormTitle">
@@ -20,7 +23,7 @@
%else:
Other information
%endif
%if info_association and not inherited and ( cntrller == 'library_admin' or can_modify ):
%if info_association and not inherited and can_modify:
## "inherited" will be true only if the info_association is not associated with the current item,
## in which case we do not want to render the following popup menu.
<a id="item-${item.id}-popup" class="popup-arrow" style="display: none;">&#9660;</a>
@@ -154,7 +157,7 @@
</div>
%elif upload_option == 'upload_directory':
<%
if cntrller == 'library_admin':
if ( trans.user_is_admin() and cntrller == 'library_admin' ):
import_dir = trans.app.config.library_import_dir
else:
# Directories of files from the Data Libraries view are restricted to a
@@ -184,7 +187,7 @@
%endif
%endfor
%else:
%if cntrller == 'library_admin':
%if ( trans.user_is_admin() and cntrller == 'library_admin' ):
<option>${import_dir}</option>
%else:
<option>${trans.user.email}</option>
@@ -368,7 +371,7 @@
<td colspan="4" style="padding-left: 42px;">
For selected items:
<select name="do_action" id="action_on_selected_items">
%if cntrller=='library_admin':
%if ( trans.user_is_admin() and cntrller=='library_admin' ):
<option value="manage_permissions">Edit permissions</option>
<option value="delete">Delete</option>
%elif cntrller=='library':
templates/library/common/folder_info.mako
+1 -1
View File
@@ -22,7 +22,7 @@
<div class="toolForm">
<div class="toolFormTitle">Edit folder name and description</div>
<div class="toolFormBody">
%if cntrller=='library_admin' or trans.app.security_agent.can_modify_library_item( current_user_roles, folder ):
%if ( trans.user_is_admin() and cntrller == 'library_admin' ) or trans.app.security_agent.can_modify_library_item( current_user_roles, folder ):
<form name="folder" action="${h.url_for( controller='library_common', action='folder_info', cntrller=cntrller, id=trans.security.encode_id( folder.id ), library_id=library_id, use_panels=use_panels, show_deleted=show_deleted )}" method="post" >
<div class="form-row">
<label>Name:</label>
templates/library/common/folder_permissions.mako
+1 -1
View File
@@ -13,7 +13,7 @@
${render_msg( message, status )}
%endif
%if cntrller in [ 'library_admin', 'requests_admin' ] or trans.app.security_agent.can_manage_library_item( current_user_roles, folder ):
%if ( trans.user_is_admin() and cntrller in [ 'library_admin', 'requests_admin' ] ) or trans.app.security_agent.can_manage_library_item( current_user_roles, folder ):
## LIBRARY_ACCESS is a special permission that is set only at the library level.
${render_permission_form( folder, folder.name, h.url_for( controller='library_common', action='folder_permissions', cntrller=cntrller, id=trans.security.encode_id( folder.id ), library_id=library_id, show_deleted=show_deleted ), roles, do_not_render=[ 'LIBRARY_ACCESS' ] )}
%endif
templates/library/common/ldda_edit_info.mako
+1 -1
View File
@@ -42,7 +42,7 @@
</select>
</%def>
%if cntrller=='library_admin' or trans.app.security_agent.can_modify_library_item( current_user_roles, ldda.library_dataset ):
%if ( trans.user_is_admin() and cntrller=='library_admin' ) or trans.app.security_agent.can_modify_library_item( current_user_roles, ldda.library_dataset ):
<div class="toolForm">
<div class="toolFormTitle">Edit attributes of ${ldda.name}</div>
<div class="toolFormBody">
templates/library/common/ldda_info.mako
+9 -5
View File
@@ -14,9 +14,13 @@
uploaded_by = ldda.user.email
else:
uploaded_by = 'anonymous'
if cntrller in [ 'library', 'requests' ]:
if trans.user_is_admin() and cntrller == 'library_admin':
can_modify = can_manage = True
elif cntrller in [ 'library', 'requests' ]:
can_modify = trans.app.security_agent.can_modify_library_item( current_user_roles, ldda.library_dataset )
can_manage = trans.app.security_agent.can_manage_library_item( current_user_roles, ldda.library_dataset )
else:
can_modify = can_manage = False
%>
%if current_version:
@@ -42,7 +46,7 @@
%if not library.deleted and not branch_deleted( ldda.library_dataset.folder ) and not ldda.library_dataset.deleted:
<a id="dataset-${ldda.id}-popup" class="popup-arrow" style="display: none;">&#9660;</a>
<div popupmenu="dataset-${ldda.id}-popup">
%if cntrller=='library_admin' or can_modify:
%if can_modify:
<a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a>
%if not info_association:
<a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='ldda', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), ldda_id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add template</a>
@@ -51,10 +55,10 @@
<a class="action-button" href="${h.url_for( controller='library_common', action='delete_template', cntrller=cntrller, item_type='ldda', library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), ldda_id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Delete template</a>
%endif
%endif
%if cntrller=='library_admin' or can_manage:
%if can_manage:
<a class="action-button" href="${h.url_for( controller='library_common', action='ldda_permissions', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit permissions</a>
%endif
%if current_version and ( cntrller=='library_admin' or can_modify ):
%if current_version and can_modify:
<a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), replace_id=trans.security.encode_id( ldda.library_dataset.id ) )}">Upload a new version of this dataset</a>
%endif
%if cntrller=='library' and ldda.has_data:
@@ -132,7 +136,7 @@
%if widgets:
${render_template_info( cntrller=cntrller, item_type='ldda', library_id=library_id, widgets=widgets, info_association=info_association, inherited=inherited, folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), ldda_id=trans.security.encode_id( ldda.id ), editable=False )}
%endif
%if cntrller == 'library_admin':
%if trans.user_is_admin() and cntrller == 'library_admin':
%if associated_hdas:
<p/>
<b>Active (undeleted) history items that use this library dataset's disk file</b>
templates/library/common/library_dataset_info.mako
+1 -1
View File
@@ -19,7 +19,7 @@
${render_msg( message, status )}
%endif
%if cntrller=='library_admin' or trans.app.security_agent.can_modify_library_item( current_user_roles, library_dataset ):
%if ( trans.user_is_admin() and cntrller=='library_admin' ) or trans.app.security_agent.can_modify_library_item( current_user_roles, library_dataset ):
<div class="toolForm">
<div class="toolFormTitle">Edit attributes of ${library_dataset.name}</div>
<div class="toolFormBody">
templates/library/common/library_dataset_permissions.mako
+1 -1
View File
@@ -19,7 +19,7 @@
${render_msg( message, status )}
%endif
%if cntrller == 'library_admin' or trans.app.security_agent.can_manage_library_item( current_user_roles, library_dataset ):
%if ( trans.user_is_admin() and cntrller == 'library_admin' ) or trans.app.security_agent.can_manage_library_item( current_user_roles, library_dataset ):
## LIBRARY_ACCESS is a special permission that is set only at the library level.
${render_permission_form( library_dataset, library_dataset.name, h.url_for( controller='library_common', action='library_dataset_permissions', cntrller=cntrller, id=trans.security.encode_id( library_dataset.id ), library_id=library_id, show_deleted=show_deleted ), roles, do_not_render=[ 'LIBRARY_ACCESS' ] )}
%endif
templates/library/common/library_info.mako
+15 -11
View File
@@ -4,10 +4,14 @@
<%
from cgi import escape
if cntrller in [ 'library', 'requests' ]:
if trans.user_is_admin() and cntrller == 'library_admin':
can_add = can_modify = can_manage = True
elif cntrller in [ 'library', 'requests' ]:
can_add = trans.app.security_agent.can_add_library_item( current_user_roles, library )
can_modify = trans.app.security_agent.can_modify_library_item( current_user_roles, library )
can_manage = trans.app.security_agent.can_manage_library_item( current_user_roles, library )
else:
can_add = can_modify = can_manage = False
library_name = escape( str( library.name ), quote=True )
library_description = escape( str( library.description ), quote=True )
library_synopsis = escape( str( library.synopsis ), quote=True )
@@ -25,31 +29,31 @@
%endif
<div class="toolForm">
%if cntrller == 'library_admin' or can_add or can_modify or can_manage:
<div class="toolFormTitle">
<a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}"><b>${library.name[:50]}</b></a>
<div class="toolFormTitle">
<a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}"><b>${library.name[:50]}</b></a>
%if can_add or can_modify or can_manage:
<a id="library-${library.id}-popup" class="popup-arrow" style="display: none;">&#9660;</a>
<div popupmenu="library-${library.id}-popup">
%if not library.deleted:
%if ( cntrller == 'library_admin' or can_add ) and not library.info_association:
%if can_add and not library.info_association:
<a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add template</a>
%endif
%if cntrller == 'library_admin' or can_manage:
%if can_manage:
<a class="action-button" href="${h.url_for( controller='library_common', action='library_permissions', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit permissions</a>
%endif
%if cntrller == 'library_admin' or can_modify:
%if can_modify:
<a class="action-button" confirm="Click OK to delete the library named '${library.name}'." href="${h.url_for( controller='library_common', action='delete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( library.id ), item_type='library' )}">Delete this data library</a>
%endif
%elif ( cntrller == 'library_admin' or can_modify ) and not library.purged:
%elif can_modify and not library.purged:
<a class="action-button" href="${h.url_for( controller='library_common', action='undelete_library_item', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), item_id=trans.security.encode_id( library.id ), item_type='library' )}">Undelete this data library</a>
%elif library.purged:
<a class="action-button" href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">This data library has been purged</a>
%endif
</div>
</div>
%endif
%endif
</div>
<div class="toolFormBody">
%if not library.deleted and ( cntrller == 'library_admin' or can_modify ):
%if not library.deleted and can_modify:
<form name="library" action="${h.url_for( controller='library_common', action='library_info', id=trans.security.encode_id( library.id ), cntrller=cntrller, use_panels=use_panels, show_deleted=show_deleted )}" method="post" >
<div class="form-row">
<label>Name:</label>
templates/library/common/library_permissions.mako
+1 -1
View File
@@ -13,6 +13,6 @@
${render_msg( message, status )}
%endif
%if cntrller == 'library_admin' or trans.app.security_agent.can_manage_library_item( current_user_roles, library ):
%if ( trans.user_is_admin() and cntrller == 'library_admin' ) or trans.app.security_agent.can_manage_library_item( current_user_roles, library ):
${render_permission_form( library, library.name, h.url_for( controller='library_common', action='library_permissions', cntrller=cntrller, id=trans.security.encode_id( library.id ), show_deleted=show_deleted ), roles )}
%endif
templates/library/common/upload.mako
+1 -1
View File
@@ -27,7 +27,7 @@
<a id="upload-librarydataset--popup" class="popup-arrow" style="display: none;">&#9660;</a>
<div popupmenu="upload-librarydataset--popup">
<a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller,library_id=library_id, folder_id=folder_id, replace_id=replace_id, upload_option='upload_file', show_deleted=show_deleted )}">Upload files</a>
%if cntrller == 'library_admin':
%if ( trans.user_is_admin() and cntrller == 'library_admin' ):
%if trans.app.config.library_import_dir and os.path.exists( trans.app.config.library_import_dir ):
<a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=library_id, folder_id=folder_id, replace_id=replace_id, upload_option='upload_directory', show_deleted=show_deleted )}">Upload directory of files</a>
%endif
test/base/twilltestcase.py
+6 -6
View File
@@ -1675,7 +1675,7 @@ class TwillTestCase( unittest.TestCase ):
tc.fv( '1', 'description', new_description )
tc.fv( '1', 'synopsis', new_synopsis )
tc.submit( 'library_info_button' )
self.check_page_for_string( "The information has been updated." )
self.check_page_for_string( "Information updated for library" )
# If there is a template, then there are 2 forms on this page and the template is the 2nd form
if ele_1_field_name and ele_1_contents and ele_2_field_name and ele_2_contents:
tc.fv( '2', ele_1_field_name, ele_1_contents )
@@ -1687,7 +1687,7 @@ class TwillTestCase( unittest.TestCase ):
self.home()
def library_permissions( self, library_id, library_name, role_ids_str, permissions_in, permissions_out, cntrller='library_admin' ):
# role_ids_str must be a comma-separated string of role ids
url = "library_common/library_permissions?id=%s&cntrller=%slibrary_admin&update_roles_button=Save" % ( library_id, cntrller )
url = "library_common/library_permissions?id=%s&cntrller=%s&update_roles_button=Save" % ( library_id, cntrller )
for po in permissions_out:
key = '%s_out' % po
url ="%s&%s=%s" % ( url, key, role_ids_str )
@@ -1696,7 +1696,7 @@ class TwillTestCase( unittest.TestCase ):
url ="%s&%s=%s" % ( url, key, role_ids_str )
self.home()
self.visit_url( "%s/%s" % ( self.url, url ) )
check_str = "Permissions updated for library '%s'" % library_name
check_str = "Permissions updated for library '%s'." % library_name
self.check_page_for_string( check_str )
self.home()
@@ -1776,7 +1776,7 @@ class TwillTestCase( unittest.TestCase ):
self.library_wait( library_id )
self.home()
def ldda_permissions( self, cntrller, library_id, folder_id, id, role_ids_str,
permissions_in=[], permissions_out=[], check_str1='' ):
permissions_in=[], permissions_out=[], check_str1='', ldda_name='' ):
# role_ids_str must be a comma-separated string of role ids
url = "%s/library_common/ldda_permissions?cntrller=%s&library_id=%s&folder_id=%s&id=%s" % \
( self.url, cntrller, library_id, folder_id, id )
@@ -1792,7 +1792,7 @@ class TwillTestCase( unittest.TestCase ):
if check_str1:
check_str = check_str1
else:
check_str = "Permissions have been updated on 1 datasets"
check_str = "Permissions updated for dataset '%s'." % ldda_name
self.check_page_for_string( check_str )
self.home()
def ldda_edit_info( self, cntrller, library_id, folder_id, ldda_id, ldda_name, new_ldda_name='',
@@ -1808,7 +1808,7 @@ class TwillTestCase( unittest.TestCase ):
if new_ldda_name:
tc.fv( '1', 'name', new_ldda_name )
tc.submit( 'save' )
check_str = 'Attributes updated for library dataset %s' % new_ldda_name
check_str = "Attributes updated for library dataset '%s'." % new_ldda_name
self.check_page_for_string( check_str )
# There are 4 forms on this page and the template is the 4th form
if ele_1_field_name and ele_1_contents:
test/functional/test_library_security.py
+4 -3
View File
@@ -231,7 +231,8 @@ class TestLibrarySecurity( TwillTestCase ):
self.security.encode_id( ldda_one.id ),
role_ids_str,
permissions_in,
permissions_out )
permissions_out,
ldda_name=ldda_one.name )
# admin_user should now be able to see 1.bed from the analysis view's access libraries
self.browse_library( 'library',
self.security.encode_id( library_one.id ),
@@ -370,7 +371,7 @@ class TestLibrarySecurity( TwillTestCase ):
ldda_ids,
str( role_one.id ),
permissions_in=[ 'DATASET_ACCESS', 'LIBRARY_MANAGE' ],
check_str1='Permissions have been updated on 3 datasets' )
check_str1='Permissions updated for 3 datasets.' )
# Make sure the permissions have been correctly updated for the 3 datasets. Permissions should
# be all of the above on any of the 3 datasets that are imported into a history.
def check_edit_page( lddas, check_str1='', check_str2='', check_str3='', check_str4='',
@@ -417,7 +418,7 @@ class TestLibrarySecurity( TwillTestCase ):
ldda_ids,
str( role_one.id ),
permissions_in=[ 'DATASET_ACCESS' ],
check_str1='Permissions have been updated on 3 datasets' )
check_str1='Permissions updated for 3 datasets.' )
check_edit_page( latest_3_lddas,
check_str1='View Permissions',
not_displayed1='Manage dataset permissions on',