Unverified Commit 58d64fa9 authored by davelopez's avatar davelopez
Browse files

Add ownership check to LDDAManager for library dataset associations

parent 97b7476e
Loading
Loading
Loading
Loading
+14 −0
Original line number Diff line number Diff line
import logging
from typing import (
    Any,
    Optional,
)

from galaxy import model
from galaxy.managers import base as manager_base
@@ -26,6 +30,16 @@ class LDDAManager(DatasetAssociationManager):
            trans, id, "LibraryDatasetDatasetAssociation", check_ownership=False, check_accessible=check_accessible
        )

    def is_owner(self, item: model.Base, user: Optional[model.User], **kwargs: Any) -> bool:
        """
        Return True if user owns the item.
        """
        if not isinstance(item, model.LibraryDatasetDatasetAssociation):
            raise TypeError('"item" must be a LibraryDatasetDatasetAssociation.')
        if self.app.config.is_admin_user(user):
            return True
        return item.user == user

    def _set_permissions(self, trans, library_dataset, role_ids_dict):
        # Check Git history for an older broken implementation, but it was broken
        # and security related and had not test coverage so it was deleted.