Unverified Commit 91d9d494 authored by Marius van den Beek's avatar Marius van den Beek Committed by GitHub
Browse files

Merge pull request #17459 from mvdbeek/backport_public_hdca_check 

[23.1] Only check access permissions in `/api/{history_dataset_collection_id}/contents/{dataset_collection_id}`
parents c94ec0d4 d18003e6

lib/galaxy/webapps/galaxy/services/dataset_collections.py

+1 −1
Original line number Diff line number Diff line
@@ -250,7 +250,7 @@ class DatasetCollectionsService(ServiceBase, UsesLibraryMixinItems): 
                "Parameter instance_type not being 'history' is not yet implemented."

            )

        hdca: "HistoryDatasetCollectionAssociation" = self.collection_manager.get_dataset_collection_instance(

            trans, "history", hdca_id, check_ownership=True

            trans, "history", hdca_id

        )



        # check to make sure the dsc is part of the validated hdca

lib/galaxy_test/api/test_dataset_collections.py

+12 −0
Original line number Diff line number Diff line
@@ -418,6 +418,18 @@ class TestDatasetCollectionsApi(ApiTestCase): 
            contents_response = self._get(contents_url)

            self._assert_status_code_is(contents_response, 403)



    @requires_new_user

    def test_published_collection_contents_accessible(self, history_id):

        # request contents on an hdca that is in a published history

        hdca, contents_url = self._create_collection_contents_pair(history_id)

        with self._different_user():

            contents_response = self._get(contents_url)

            self._assert_status_code_is(contents_response, 403)

        self.dataset_populator.make_public(history_id)

        with self._different_user():

            contents_response = self._get(contents_url)

            self._assert_status_code_is(contents_response, 200)



    def test_collection_contents_invalid_collection(self, history_id):

        # request an invalid collection from a valid hdca, should get 404

        hdca, contents_url = self._create_collection_contents_pair(history_id)