Unverified Commit 5141a0f6 authored by Martin Cech's avatar Martin Cech Committed by GitHub
Browse files

Merge pull request #15826 from martenson/release_22.01 

[22.01] add security checks to page and visualization APIs
parents d62235fc e2d0ef27

lib/galaxy/webapps/galaxy/controllers/page.py

+3 −1
Original line number Diff line number Diff line
@@ -292,8 +292,9 @@ class PageController(BaseUIController, SharableMixin, 
            operation = kwargs['operation'].lower()

            ids = util.listify(kwargs['id'])

            for id in ids:

                item = session.query(model.Page).get(self.decode_id(id))

                if operation == "delete":

                    item = session.query(model.Page).get(self.decode_id(id))

                    self.security_check(trans, item, check_ownership=True)

                    item.deleted = True

            session.flush()
@@ -393,6 +394,7 @@ class PageController(BaseUIController, SharableMixin, 
        decoded_id = self.decode_id(id)

        user = trans.get_user()

        p = trans.sa_session.query(model.Page).get(decoded_id)

        p = self.security_check(trans, p, check_ownership=True)

        if trans.request.method == 'GET':

            if p.slug is None:

                self.slug_builder.create_item_slug(trans.sa_session, p)

lib/galaxy/webapps/galaxy/controllers/visualization.py

+3 −3
Original line number Diff line number Diff line
@@ -287,8 +287,8 @@ class VisualizationController(BaseUIController, SharableMixin, UsesVisualization 
            operation = kwargs['operation'].lower()

            ids = util.listify(kwargs['id'])

            for id in ids:

                item = session.query(model.Visualization).get(self.decode_id(id))

                if operation == "delete":

                    item = self.get_visualization(trans, id)

                    item.deleted = True

                if operation == "copy":

                    self.copy(trans, **kwargs)
@@ -327,7 +327,7 @@ class VisualizationController(BaseUIController, SharableMixin, UsesVisualization 
    @web.expose

    @web.require_login()

    def copy(self, trans, id, **kwargs):

        visualization = self.get_visualization(trans, id, check_ownership=False)

        visualization = self.get_visualization(trans, id, check_ownership=False, check_accessible=True)

        user = trans.get_user()

        owner = (visualization.user == user)

        new_title = f"Copy of '{visualization.title}'"
@@ -390,7 +390,7 @@ class VisualizationController(BaseUIController, SharableMixin, UsesVisualization 


        # Do import.

        session = trans.sa_session

        visualization = self.get_visualization(trans, id, check_ownership=False)

        visualization = self.get_visualization(trans, id, check_ownership=False, check_accessible=True)

        if visualization.importable is False:

            return trans.show_error_message(f"The owner of this visualization has disabled imports via this link.<br>You can {referer_message}", use_panels=True)

        elif visualization.deleted: