girder 3.2.16.dev1__tar.gz → 3.2.19.dev1__tar.gz

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/.circleci/publish_npm.sh

@@ -1,7 +1,12 @@
 #!/bin/bash
 set -e
-# Publish npm packages for selected locations
-# NPM_AUTH_TOKEN must be set by the build environment
+# Publish npm packages for selected locations, using npm trusted publishing
+# (CircleCI OIDC). No NPM_AUTH_TOKEN is needed.
+export NPM_CONFIG_PREFIX="$HOME/.npm-global"
+npm install -g 'npm@^11.5.1'
+export PATH="$NPM_CONFIG_PREFIX/bin:$PATH"
+hash -r
+npm --version
 
 readonly GIT_VERSION=$(git describe --tags)
 readonly PUBLISHED_NPM_PACKAGES=(
@@ -19,10 +24,10 @@ readonly PUBLISHED_NPM_PACKAGES=(
 )
 for directory in "${PUBLISHED_NPM_PACKAGES[@]}"; do
   pushd "$directory"
-  # Trying to set the auth token via 'npm_config_' environment variables does not work
-  echo '//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}' > ./.npmrc
   npm version --allow-same-version --no-git-tag-version "$GIT_VERSION"
+  # OIDC tokens are short-lived, so fetch a fresh one for each publish
+  export NPM_ID_TOKEN=$(circleci run oidc get --claims '{"aud": "npm:registry.npmjs.org"}')
   npm publish --access public
-  rm --interactive=never ./.npmrc
   popd
 done
+

{girder-3.2.16.dev1/girder.egg-info → girder-3.2.19.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 3.2.16.dev1
+Version: 3.2.19.dev1
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/api/v1/folder.py

@@ -429,4 +429,4 @@ class Folder(Resource):
         .errorResponse('Read access was denied for the folder.', 403)
     )
     def rootpath(self, folder, params):
-        return self._model.parentsToRoot(folder, user=self.getCurrentUser())
+        return self._model.parentsToRoot(folder, user=self.getCurrentUser(), hideInaccessible=True)

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/api/v1/group.py

@@ -221,6 +221,12 @@ class Group(Resource):
                     mustBeAdmin = False
                 if mustBeAdmin:
                     self.requireAdmin(user)
+            if not user['admin']:
+                # A non-site-admin may only grant an access level that they
+                # themselves hold. Without this clamp, a moderator (WRITE)
+                # could promote an arbitrary user to ADMIN via the force path,
+                # bypassing the level check that the non-force branch applies.
+                groupModel.requireAccess(group, user, level)
             groupModel.addUser(group, userToInvite, level=level)
         else:
             # Can only invite into access levels that you yourself have

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/api/v1/item.py

@@ -313,7 +313,7 @@ class Item(Resource):
         .errorResponse('Read access was denied for the item.', 403)
     )
     def rootpath(self, item):
-        return self._model.parentsToRoot(item, self.getCurrentUser())
+        return self._model.parentsToRoot(item, self.getCurrentUser(), hideInaccessible=True)
 
     @access.user(scope=TokenScope.DATA_WRITE)
     @filtermodel(model=ItemModel)

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/api/v1/user.py

@@ -136,7 +136,7 @@ class User(Resource):
     def logout(self):
         token = self.getCurrentToken()
         if token:
-            Token().remove(token)
+            Token().expire(token)
         self.deleteAuthTokenCookie()
         return {'message': 'Logged out.'}
 

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/models/folder.py

@@ -564,7 +564,15 @@ class Folder(AccessControlledModel):
 
         return filteredDoc
 
-    def parentsToRoot(self, folder, curPath=None, user=None, force=False, level=AccessType.READ):
+    def parentsToRoot(
+        self,
+        folder,
+        curPath=None,
+        user=None,
+        force=False,
+        level=AccessType.READ,
+        hideInaccessible=False,
+    ):
         """
         Get the path to traverse to a root of the hierarchy.
 
@@ -572,6 +580,7 @@ class Folder(AccessControlledModel):
         :type folder: dict
         :returns: an ordered list of dictionaries from root to the current folder
         """
+        force = force or hideInaccessible
         curPath = curPath or []
         curParentId = folder['parentId']
         curParentType = folder['parentCollection']
@@ -585,10 +594,30 @@ class Folder(AccessControlledModel):
             else:
                 parentFiltered = ModelImporter.model(curParentType).filter(curParentObject, user)
 
-            return [{
+            curPaths = [{
                 'type': curParentType,
                 'object': parentFiltered
             }] + curPath
+            if hideInaccessible:
+                consolidatedPaths = []
+                # Walk the hierarchy from root to leaf, and return only the objects
+                # that the user has access to, providing they don't leak any parent
+                # information to the client.
+                for path in curPaths:
+                    pathModel = ModelImporter.model(path['type'])
+                    if not pathModel.hasAccess(path['object'], user, level):
+                        # If the user does not have access to a folder/collection/user,
+                        # discard all the accumulated hierarchy so as to not leak any
+                        # relational information.
+                        consolidatedPaths = []
+                        continue
+                    consolidatedPaths.append({
+                        'type': path['type'],
+                        'object': pathModel.filter(path['object'], user)
+                    })
+
+                return consolidatedPaths
+            return curPaths
         else:
             curParentObject = self.load(curParentId, user=user, level=level, force=force)
             curPath = [{
@@ -596,7 +625,13 @@ class Folder(AccessControlledModel):
                 'object': curParentObject if force else self.filter(curParentObject, user)
             }] + curPath
 
-            return self.parentsToRoot(curParentObject, curPath, user=user, force=force)
+            return self.parentsToRoot(
+                curParentObject,
+                curPath,
+                user=user,
+                force=force,
+                hideInaccessible=hideInaccessible
+            )
 
     def countItems(self, folder):
         """

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/models/item.py

@@ -374,7 +374,7 @@ class Item(acl_mixin.AccessControlMixin, Model):
 
         return self.save(item)
 
-    def parentsToRoot(self, item, user=None, force=False):
+    def parentsToRoot(self, item, user=None, force=False, hideInaccessible=False):
         """
         Get the path to traverse to a root of the hierarchy.
 
@@ -393,7 +393,12 @@ class Item(acl_mixin.AccessControlMixin, Model):
         curFolder = folderModel.load(
             item['folderId'], user=user, level=AccessType.READ, force=force)
         folderIdsToRoot = folderModel.parentsToRoot(
-            curFolder, user=user, level=AccessType.READ, force=force)
+            curFolder,
+            user=user,
+            level=AccessType.READ,
+            force=force,
+            hideInaccessible=hideInaccessible,
+        )
 
         if force:
             folderIdsToRoot.append({'type': 'folder', 'object': curFolder})

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/models/model_base.py

@@ -43,12 +43,18 @@ def _permissionClauses(user=None, level=None, prefix=''):
     :returns: A query dictionary with an '$or' entry which consists of a list
         of match clauses, any one of which implies validation.
     """
+    from girder.models.setting import Setting
+    from girder.settings import SettingKey
+
     permissionClauses = []
     if level is None or (user and user['admin']):
         # Without a level or with an admin user, match everything.
         return {}
     if level <= AccessType.READ:
-        permissionClauses.append({prefix + 'public': True})
+        if user or not Setting().get(SettingKey.DISABLE_ANONYMOUS_ACCESS):
+            permissionClauses.append({prefix + 'public': True})
+        else:
+            return {'__matchnothing': 'nothing'}
     elif not user:
         # If we have no user and asked for higher than read access, make a
         # query that will fail
@@ -1205,9 +1211,12 @@ class AccessControlledModel(Model):
         """
         if user is None:
             if doc.get('public', False):
-                return AccessType.READ
-            else:
-                return AccessType.NONE
+                from girder.models.setting import Setting
+                from girder.settings import SettingKey
+
+                if not Setting().get(SettingKey.DISABLE_ANONYMOUS_ACCESS):
+                    return AccessType.READ
+            return AccessType.NONE
         elif user['admin']:
             return AccessType.ADMIN
         else:
@@ -1357,8 +1366,14 @@ class AccessControlledModel(Model):
         :returns: Whether the access is granted.
         """
         if level <= AccessType.READ and doc.get('public', False) is True:
-            # Short-circuit the case of public resources
-            return True
+            from girder.models.setting import Setting
+            from girder.settings import SettingKey
+
+            if user is not None or not Setting().get(SettingKey.DISABLE_ANONYMOUS_ACCESS):
+                # Short-circuit the case of public resources
+                return True
+            elif user is None:
+                return False
         elif user is None:
             # Anonymous users can only see public resources
             return False

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/models/token.py

@@ -135,3 +135,13 @@ class Token(AccessControlledModel):
         """
         for token in self.find({'apiKeyId': apiKey['_id']}):
             self.remove(token)
+
+    def expire(self, token: dict):
+        """
+        Expire a token immediately.
+
+        :param token: The token document to expire.
+        """
+        expires = datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(seconds=1)
+        self.update({'_id': token['_id']}, {'$set': {'expires': expires}})
+        return self.save(token)

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/settings.py

@@ -26,11 +26,13 @@ class SettingKey:
     CORS_ALLOW_METHODS = 'core.cors.allow_methods'
     CORS_ALLOW_ORIGIN = 'core.cors.allow_origin'
     CORS_EXPOSE_HEADERS = 'core.cors.expose_headers'
+    SHOW_DOWNLOAD = 'core.show_download'
     EMAIL_FROM_ADDRESS = 'core.email_from_address'
     EMAIL_HOST = 'core.email_host'
     EMAIL_VERIFICATION = 'core.email_verification'
     ENABLE_NOTIFICATION_STREAM = 'core.enable_notification_stream'
     ENABLE_PASSWORD_LOGIN = 'core.enable_password_login'
+    DISABLE_ANONYMOUS_ACCESS = 'core.disable_anonymous_access'
     FILEHANDLE_MAX_SIZE = 'core.filehandle_max_size'
     GIRDER_MOUNT_INFORMATION = 'core.girder_mount_information'
     HTTP_ONLY_COOKIES = 'core.http_only_cookies'
@@ -73,6 +75,7 @@ class SettingDefault:
         SettingKey.CORS_ALLOW_METHODS: 'GET, POST, PUT, HEAD, DELETE',
         SettingKey.CORS_ALLOW_ORIGIN: '',
         SettingKey.CORS_EXPOSE_HEADERS: 'Girder-Total-Count, Content-Disposition',
+        SettingKey.SHOW_DOWNLOAD: 'all',
         # An apache server using reverse proxy would also need
         #  X-Requested-With, X-Forwarded-Server, X-Forwarded-For,
         #  X-Forwarded-Host, Remote-Addr
@@ -81,6 +84,7 @@ class SettingDefault:
         SettingKey.EMAIL_VERIFICATION: 'disabled',
         SettingKey.ENABLE_NOTIFICATION_STREAM: True,
         SettingKey.ENABLE_PASSWORD_LOGIN: True,
+        SettingKey.DISABLE_ANONYMOUS_ACCESS: False,
         SettingKey.FILEHANDLE_MAX_SIZE: 1024 * 1024 * 16,
         SettingKey.GIRDER_MOUNT_INFORMATION: None,
         SettingKey.HTTP_ONLY_COOKIES: False,  # TODO This will go away in next major version
@@ -229,6 +233,17 @@ class SettingValidator:
         if not isinstance(doc['value'], str):
             raise ValidationException('CORS exposed headers must be a string', 'value')
 
+    @staticmethod
+    @setting_utilities.validator(SettingKey.SHOW_DOWNLOAD)
+    def _validateshowDownload(doc):
+        if not isinstance(doc['value'], str):
+            raise ValidationException(
+                'Show download must be "all", "user", "admin", or "none".', 'value')
+        doc['value'] = doc['value'].lower()
+        if doc['value'] not in ('all', 'user', 'admin', 'none'):
+            raise ValidationException(
+                'Show download must be "all", "user", "admin", or "none".', 'value')
+
     @staticmethod
     @setting_utilities.validator(SettingKey.EMAIL_FROM_ADDRESS)
     def _validateEmailFromAddress(doc):
@@ -265,6 +280,12 @@ class SettingValidator:
         if not isinstance(doc['value'], bool):
             raise ValidationException('Enable password login setting must be boolean.', 'value')
 
+    @staticmethod
+    @setting_utilities.validator(SettingKey.DISABLE_ANONYMOUS_ACCESS)
+    def _validateDisableAnonymousAccess(doc):
+        if not isinstance(doc['value'], bool):
+            raise ValidationException('Disable anonymous access setting must be boolean.', 'value')
+
     @staticmethod
     @setting_utilities.validator(SettingKey.FILEHANDLE_MAX_SIZE)
     def _validateFilehandleMaxSize(doc):

girder-3.2.19.dev1/girder/utility/_hash_state.py

@@ -0,0 +1,261 @@
+# Utility for saving and restoring the internal state of a hash object
+# so that checksums can be streamed without having to remain in memory.
+# Inspired by http://code.activestate.com/recipes/
+# 578479-save-and-restore-sha-512-internal-state/
+
+import binascii
+import ctypes
+import hashlib
+import ssl
+import sys
+
+_ver = sys.version_info
+_free_threaded = hasattr(sys, '_is_gil_enabled') and not sys._is_gil_enabled()
+_WORD = ctypes.sizeof(ctypes.c_void_p)
+
+# This is the offset to the EVP_MD_CTX structure in CPython's _hashopenssl.c
+# EVPObject.  It changed for Python 3.8 in
+# https://github.com/python/cpython/pull/16023 and again for the free-threaded
+# builds in 3.14 (which add two words to the object header) and for all builds
+# in 3.15 (which add one word).  These values are only used as a fallback on
+# platforms where we cannot safely auto-detect the layout.
+if _free_threaded:
+    _HASHLIB_EVP_STRUCT_OFFSET = 5 if _ver >= (3, 15) else 4
+else:
+    _HASHLIB_EVP_STRUCT_OFFSET = 3 if _ver >= (3, 15) else 2
+
+# Number of pointer-sized words to scan when auto-detecting the layout of
+# CPython's _hashlib.HASH object and the OpenSSL EVP_MD_CTX structure it
+# references.  The digest state has never been stored inline in the hash
+# object (since CPython 2.7.13), so it is always reachable via two levels of
+# pointers: the hash object points to an EVP_MD_CTX, which points to the
+# state data.
+_HASHLIB_OBJECT_SCAN_WORDS = 10
+_EVP_MD_CTX_SCAN_WORDS = 16
+
+# Minimum plausible heap address; anything smaller is not a real pointer.
+_MIN_VALID_ADDRESS = 0x1000
+
+# Auto-detected offsets, in units of words: (offset of the EVP_MD_CTX pointer
+# within the hash object, offset of the state data pointer within the
+# EVP_MD_CTX).  Set once the first hash object has been inspected and reused
+# for all subsequent objects, since the layout is the same for every hash
+# algorithm within a single interpreter build.
+_STATE_OFFSETS = None
+
+
+def _readPointer(address):
+    return ctypes.cast(address, ctypes.POINTER(ctypes.c_void_p))[0]
+
+
+def _getReadableAddressRanges():
+    """
+    Get the readable memory ranges of the current process, used to validate
+    candidate pointers before dereferencing them.
+
+    :returns: A list of (start, end) address tuples, or None if the platform
+        does not provide the information (in which case hardcoded offsets are
+        used instead).
+    """
+    try:
+        with open('/proc/self/maps') as mapsFile:
+            ranges = []
+            for line in mapsFile:
+                fields = line.split()
+                if 'r' not in fields[1]:
+                    continue
+                start, end = fields[0].split('-')
+                ranges.append((int(start, 16), int(end, 16)))
+            return ranges
+    except (OSError, IndexError, ValueError):
+        return None
+
+
+def _isValidAddress(ranges, address, size):
+    """
+    Check that an address range is safe to read without segfaulting.
+    """
+    if not address or address < _MIN_VALID_ADDRESS:
+        return False
+    return any(start <= address and address + size <= end for start, end in ranges)
+
+
+def _locateStateDataAddress(hashObject, initVectorFirstWord, stateSize):
+    """
+    Find the address of the internal hash state of a hash object.
+
+    When possible, this is done by scanning the hash object for a pointer to
+    an OpenSSL EVP_MD_CTX and scanning that for a pointer to memory that
+    begins with the algorithm's initialization vector.  This avoids depending
+    on hardcoded struct offsets, which CPython has repeatedly changed (see
+    the fallback offsets below the imports).  On platforms where memory
+    ranges cannot be enumerated, the hardcoded offsets are used instead.
+
+    :param hashObject: A hashlib hash object backed by OpenSSL
+        (_hashlib.HASH).
+    :param initVectorFirstWord: The first eight bytes of the digest state of a
+        freshly initialized hash object of this algorithm.
+    :param stateSize: The size in bytes of the digest state.
+    :return: The address of the digest state, or None if it could not be
+        located.
+    """
+    global _STATE_OFFSETS
+    objectAddress = id(hashObject)
+
+    if _STATE_OFFSETS is not None:
+        objectOffset, ctxOffset = _STATE_OFFSETS
+        ctxAddress = _readPointer(objectAddress + objectOffset * _WORD)
+        return _readPointer(ctxAddress + ctxOffset * _WORD)
+
+    ranges = _getReadableAddressRanges()
+    if ranges is None:
+        # Platforms without /proc/self/maps, such as macOS and Windows.
+        ctxAddress = _readPointer(objectAddress + _HASHLIB_EVP_STRUCT_OFFSET * _WORD)
+        if ssl._OPENSSL_API_VERSION < (3, 0):
+            # OpenSSL 1.x
+            return _readPointer(ctxAddress + 3 * _WORD)
+        # OpenSSL 3.x
+        return _readPointer(ctxAddress + 7 * _WORD)
+
+    for objectOffset in range(2, _HASHLIB_OBJECT_SCAN_WORDS):
+        ctxAddress = _readPointer(objectAddress + objectOffset * _WORD)
+        if not _isValidAddress(ranges, ctxAddress, _EVP_MD_CTX_SCAN_WORDS * _WORD):
+            continue
+        for ctxOffset in range(_EVP_MD_CTX_SCAN_WORDS):
+            stateAddress = _readPointer(ctxAddress + ctxOffset * _WORD)
+            if not _isValidAddress(ranges, stateAddress, stateSize):
+                continue
+            if ctypes.cast(
+                stateAddress, ctypes.POINTER(ctypes.c_char)
+            )[:8] == initVectorFirstWord:
+                _STATE_OFFSETS = (objectOffset, ctxOffset)
+                return stateAddress
+    return None
+
+
+def _getStateDataPointer(hashObject, hashInfo):
+    """
+    Get a pointer to the internal hash state of a hash object.
+
+    :param hashObject: A hashlib hash object.
+    :param hashInfo: The _HashInfo instance describing the hash algorithm.
+    :return: A ctypes pointer to the internal hash state.
+    :rtype: ctypes.POINTER(ctypes.c_char)
+    """
+    stateAddress = _locateStateDataAddress(
+        hashObject, hashInfo.initVectorFirstWord, hashInfo.stateSize)
+    if stateAddress is None:
+        raise RuntimeError(
+            'Could not locate the internal state of the %s hash object. This module '
+            'requires a CPython build with OpenSSL-backed hashlib.' % hashInfo.name)
+    return ctypes.cast(stateAddress, ctypes.POINTER(ctypes.c_char))
+
+
+_HASH_INFOS = {}
+
+
+class _HashInfo:
+    def __init__(self, type, stateSize, initVectorFirstWord):
+        self.type = type
+        self.stateSize = stateSize
+        self.initVectorFirstWord = initVectorFirstWord
+
+        # Instantiate to get the name and do a sanity check
+        instance = self.type()
+        self.name = instance.name
+
+        stateDataPointer = _getStateDataPointer(instance, self)
+        assert stateDataPointer[:8] == initVectorFirstWord
+
+        _HASH_INFOS[self.name] = self
+
+
+_HashInfo(
+    type=hashlib.md5,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/md5/md5.h#L100
+    stateSize=92,
+    # Found empirically
+    initVectorFirstWord=b'\x01\x23\x45\x67\x89\xab\xcd\xef'
+)
+_HashInfo(
+    type=hashlib.sha1,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha.h#L100
+    stateSize=96,
+    # Found empirically
+    initVectorFirstWord=b'\x01\x23\x45\x67\x89\xab\xcd\xef'
+)
+_HashInfo(
+    type=hashlib.sha224,
+    # Uses the same struct as sha256
+    stateSize=112,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha256.c#L22
+    initVectorFirstWord=b'\xd8\x9e\x05\xc1\x07\xd5\x7c\x36'
+)
+_HashInfo(
+    type=hashlib.sha256,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha.h#L135
+    stateSize=112,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha256.c#L33
+    initVectorFirstWord=b'\x67\xe6\x09\x6a\x85\xae\x67\xbb'
+)
+_HashInfo(
+    type=hashlib.sha384,
+    # Uses the same struct as sha512
+    stateSize=216,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha512.c#L64
+    initVectorFirstWord=b'\xd8\x9e\x05\xc1\x5d\x9d\xbb\xcb'
+)
+_HashInfo(
+    type=hashlib.sha512,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha.h#L182
+    stateSize=216,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha512.c#L80
+    initVectorFirstWord=b'\x08\xc9\xbc\xf3\x67\xe6\x09\x6a'
+)
+
+
+def serialize(hashObject):
+    """
+    Serializes the internal state of the hash object passed in. Calling
+    restore() on the serialized value afterward will return an equivalent
+    hash object to the one passed.
+
+    :param hashObject: The hash object to serialize.
+    :type hashObject: _hashlib.HASH
+    :returns: A binary string representing the serialized state.
+    """
+    hashInfo = _HASH_INFOS[hashObject.name]
+    stateDataPointer = _getStateDataPointer(hashObject, hashInfo)
+    return stateDataPointer[:hashInfo.stateSize]
+
+
+def restore(oldStateData, hashName):
+    """
+    Unserializes a hash object from a binary string created by the
+    serialize() method in this module.
+
+    :param oldStateData: The serialized state.
+    :type oldStateData: binary string
+    :param hashName: The name of the hash algorithm type.
+    :type hashName: str
+    :returns: A hash object in the same state as the one that serialize()
+              was called on.
+    """
+    hashInfo = _HASH_INFOS[hashName]
+    assert len(oldStateData) == hashInfo.stateSize
+
+    hashObject = hashInfo.type()
+    stateDataPointer = _getStateDataPointer(hashObject, hashInfo)
+
+    for i, byte in enumerate(oldStateData):
+        stateDataPointer[i] = byte
+
+    return hashObject
+
+
+def serializeHex(hashObject):
+    return binascii.b2a_hex(serialize(hashObject))
+
+
+def restoreHex(oldHexStateData, hashName):
+    return restore(binascii.a2b_hex(oldHexStateData), hashName)

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/utility/webroot.mako

@@ -24,7 +24,8 @@
                 brandName: '${brandName | js}',
                 bannerColor: '${bannerColor | js}',
                 registrationPolicy: '${registrationPolicy | js}',
-                enablePasswordLogin: ${enablePasswordLogin | n,json,js}
+                enablePasswordLogin: ${enablePasswordLogin | n,json,js},
+                showDownload: '${showDownload | js}'
             }).render();
             girder.events.trigger('g:appload.after', girder.app);
         });

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/utility/webroot.py

@@ -122,5 +122,6 @@ class Webroot(WebrootBase):
         self.vars['bannerColor'] = Setting().get(SettingKey.BANNER_COLOR)
         self.vars['registrationPolicy'] = Setting().get(SettingKey.REGISTRATION_POLICY)
         self.vars['enablePasswordLogin'] = Setting().get(SettingKey.ENABLE_PASSWORD_LOGIN)
+        self.vars['showDownload'] = Setting().get(SettingKey.SHOW_DOWNLOAD)
 
         return super()._renderHTML()

{girder-3.2.16.dev1 → girder-3.2.19.dev1}/girder/web_client/src/templates/body/collectionPage.pug

@@ -7,12 +7,14 @@
       |  Actions
       i.icon-down-dir
     ul.g-collection-actions-menu.dropdown-menu.pull-right(role="menu")
-      li(role="presentation")
-        a.g-download-collection(role="menuitem", href=collection.downloadUrl())
-          i.icon-download
-          | Download collection
-      if (collection.getAccessLevel() >= AccessType.WRITE)
+      if (showDownload)
+        li(role="presentation")
+          a.g-download-collection(role="menuitem", href=collection.downloadUrl())
+            i.icon-download
+            | Download collection
+      if (showDownload && collection.getAccessLevel() >= AccessType.WRITE)
         li.divider(role="presentation")
+      if (collection.getAccessLevel() >= AccessType.WRITE)
         li(role="presentation")
           a.g-edit-collection(role="menuitem")
             i.icon-edit

girder-3.2.19.dev1/girder/web_client/src/templates/body/itemPage.pug

@@ -0,0 +1,64 @@
+.g-item-breadcrumb-container
+.g-item-header
+
+  .pull-right
+    if (accessLevel >= AccessType.WRITE)
+      button.g-upload-into-item.btn.btn-sm.btn-success(title="Upload files into item")
+        i.icon-upload
+    if showDownload || accessLevel >= AccessType.WRITE
+      .btn-group
+        button.g-item-actions-button.btn.btn-sm.btn-default.dropdown-toggle(
+            data-toggle="dropdown", title="Item actions")
+          i.icon-doc-text-inv
+          |  Actions
+          i.icon-down-dir
+        ul.g-item-actions-menu.dropdown-menu.pull-right(role="menu")
+          if (showDownload)
+            li(role="presentation")
+              a.g-download-item(role="menuitem", href=item.downloadUrl())
+                i.icon-download
+                | Download item
+          if (showDownload && accessLevel >= AccessType.WRITE)
+            li.divider(role="presentation")
+          if (accessLevel >= AccessType.WRITE)
+            li(role="presentation")
+              a.g-edit-item(role="menuitem")
+                i.icon-edit
+                | Edit item
+            li.divider(role="presentation")
+            li(role="presentation")
+              a.g-delete-item(role="menuitem")
+                i.icon-trash
+                | Delete item
+
+  .g-item-name.g-body-title= item.name()
+
+.g-item-description!= renderMarkdown(item.get('description'))
+
+.g-item-info
+  .g-item-info-header
+    i.icon-info
+    | Info
+  .g-item-size.g-info-list-entry
+    i.icon-hdd
+    if item.get('size') < 1024
+      | #{item.get('size')} bytes
+    else
+      | #{formatSize(item.get('size'))} (#{item.get('size')} bytes)
+  .g-item-created.g-info-list-entry
+    i.icon-clock
+    | Created on #{formatDate(item.get('created'), DATE_SECOND)}
+  .g-item-updated.g-info-list-entry
+    i.icon-clock
+    | Updated on #{formatDate(item.get('updated'), DATE_SECOND)}
+  .g-item-id.g-info-list-entry
+    i.icon-share
+    | Unique ID: #{item.id}
+
+.g-item-metadata
+
+.g-item-files
+  .g-item-files-header
+    i.icon-docs
+    |  Files &amp; links
+  .g-item-files-container