girder 3.2.16.dev8__tar.gz → 3.2.17.dev4__tar.gz

{girder-3.2.16.dev8/girder.egg-info → girder-3.2.17.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 3.2.16.dev8
+Version: 3.2.17.dev4
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

{girder-3.2.16.dev8 → girder-3.2.17.dev4}/girder/api/v1/folder.py

@@ -429,4 +429,4 @@ class Folder(Resource):
         .errorResponse('Read access was denied for the folder.', 403)
     )
     def rootpath(self, folder, params):
-        return self._model.parentsToRoot(folder, user=self.getCurrentUser())
+        return self._model.parentsToRoot(folder, user=self.getCurrentUser(), hideInaccessible=True)

{girder-3.2.16.dev8 → girder-3.2.17.dev4}/girder/api/v1/item.py

@@ -313,7 +313,7 @@ class Item(Resource):
         .errorResponse('Read access was denied for the item.', 403)
     )
     def rootpath(self, item):
-        return self._model.parentsToRoot(item, self.getCurrentUser())
+        return self._model.parentsToRoot(item, self.getCurrentUser(), hideInaccessible=True)
 
     @access.user(scope=TokenScope.DATA_WRITE)
     @filtermodel(model=ItemModel)

{girder-3.2.16.dev8 → girder-3.2.17.dev4}/girder/models/folder.py

@@ -564,7 +564,15 @@ class Folder(AccessControlledModel):
 
         return filteredDoc
 
-    def parentsToRoot(self, folder, curPath=None, user=None, force=False, level=AccessType.READ):
+    def parentsToRoot(
+        self,
+        folder,
+        curPath=None,
+        user=None,
+        force=False,
+        level=AccessType.READ,
+        hideInaccessible=False,
+    ):
         """
         Get the path to traverse to a root of the hierarchy.
 
@@ -572,6 +580,7 @@ class Folder(AccessControlledModel):
         :type folder: dict
         :returns: an ordered list of dictionaries from root to the current folder
         """
+        force = force or hideInaccessible
         curPath = curPath or []
         curParentId = folder['parentId']
         curParentType = folder['parentCollection']
@@ -585,10 +594,30 @@ class Folder(AccessControlledModel):
             else:
                 parentFiltered = ModelImporter.model(curParentType).filter(curParentObject, user)
 
-            return [{
+            curPaths = [{
                 'type': curParentType,
                 'object': parentFiltered
             }] + curPath
+            if hideInaccessible:
+                consolidatedPaths = []
+                # Walk the hierarchy from root to leaf, and return only the objects
+                # that the user has access to, providing they don't leak any parent
+                # information to the client.
+                for path in curPaths:
+                    pathModel = ModelImporter.model(path['type'])
+                    if not pathModel.hasAccess(path['object'], user, level):
+                        # If the user does not have access to a folder/collection/user,
+                        # discard all the accumulated hierarchy so as to not leak any
+                        # relational information.
+                        consolidatedPaths = []
+                        continue
+                    consolidatedPaths.append({
+                        'type': path['type'],
+                        'object': pathModel.filter(path['object'], user)
+                    })
+
+                return consolidatedPaths
+            return curPaths
         else:
             curParentObject = self.load(curParentId, user=user, level=level, force=force)
             curPath = [{
@@ -596,7 +625,13 @@ class Folder(AccessControlledModel):
                 'object': curParentObject if force else self.filter(curParentObject, user)
             }] + curPath
 
-            return self.parentsToRoot(curParentObject, curPath, user=user, force=force)
+            return self.parentsToRoot(
+                curParentObject,
+                curPath,
+                user=user,
+                force=force,
+                hideInaccessible=hideInaccessible
+            )
 
     def countItems(self, folder):
         """

{girder-3.2.16.dev8 → girder-3.2.17.dev4}/girder/models/item.py

@@ -374,7 +374,7 @@ class Item(acl_mixin.AccessControlMixin, Model):
 
         return self.save(item)
 
-    def parentsToRoot(self, item, user=None, force=False):
+    def parentsToRoot(self, item, user=None, force=False, hideInaccessible=False):
         """
         Get the path to traverse to a root of the hierarchy.
 
@@ -393,7 +393,12 @@ class Item(acl_mixin.AccessControlMixin, Model):
         curFolder = folderModel.load(
             item['folderId'], user=user, level=AccessType.READ, force=force)
         folderIdsToRoot = folderModel.parentsToRoot(
-            curFolder, user=user, level=AccessType.READ, force=force)
+            curFolder,
+            user=user,
+            level=AccessType.READ,
+            force=force,
+            hideInaccessible=hideInaccessible,
+        )
 
         if force:
             folderIdsToRoot.append({'type': 'folder', 'object': curFolder})

{girder-3.2.16.dev8 → girder-3.2.17.dev4}/girder/web_client/src/views/body/CollectionView.js

@@ -13,6 +13,7 @@ import { cancelRestRequests } from '@girder/core/rest';
 import { confirm } from '@girder/core/dialog';
 import { renderMarkdown, formatSize } from '@girder/core/misc';
 import events from '@girder/core/events';
+import CollectionsView from '@girder/core/views/body/CollectionsView';
 
 import CollectionPageTemplate from '@girder/core/templates/body/collectionPage.pug';
 
@@ -181,6 +182,13 @@ var CollectionView = View.extend({
             events.trigger('g:navigateTo', CollectionView, _.extend({
                 collection: collection
             }, params || {}));
+        }, this).on('g:error', function () {
+            if (params.folderId) {
+                const folderRoute = `folder/${params.folderId}`;
+                router.navigate(folderRoute, { trigger: true });
+            } else {
+                events.trigger('g:navigateTo', CollectionsView);
+            }
         }, this).fetch();
     }
 });

{girder-3.2.16.dev8 → girder-3.2.17.dev4}/girder/web_client/src/views/body/UserView.js

@@ -157,7 +157,11 @@ var UserView = View.extend({
                 user: user
             }, params || {}));
         }, this).on('g:error', function () {
-            events.trigger('g:navigateTo', UsersView);
+            if (params.folderId) {
+                router.navigate(`folder/${params.folderId}`, { trigger: true });
+            } else {
+                events.trigger('g:navigateTo', UsersView);
+            }
         }, this).fetch();
     }
 });

{girder-3.2.16.dev8 → girder-3.2.17.dev4}/girder/web_client/src/views/widgets/HierarchyWidget.js

@@ -316,12 +316,19 @@ var HierarchyWidget = View.extend({
 
     _setRoute: function () {
         if (this._routing) {
-            var route = this.breadcrumbs[0].resourceName + '/' +
-                this.breadcrumbs[0].get('_id');
-            if (this.parentModel.resourceName === 'folder') {
-                route += '/folder/' + this.parentModel.get('_id');
+            var route;
+            if (this.breadcrumbs[0].resourceName === 'folder') {
+                // Case where the user doesn't have access to the root collection/user
+                route = 'folder/' + this.parentModel.get('_id');
+                router.navigate(route);
+            } else {
+                route = this.breadcrumbs[0].resourceName + '/' +
+                    this.breadcrumbs[0].get('_id');
+                if (this.parentModel.resourceName === 'folder') {
+                    route += '/folder/' + this.parentModel.get('_id');
+                }
+                router.navigate(route);
             }
-            router.navigate(route);
             events.trigger('g:hierarchy.route', { route: route });
         }
     },

{girder-3.2.16.dev8 → girder-3.2.17.dev4/girder.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 3.2.16.dev8
+Version: 3.2.17.dev4
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

girder-3.2.17.dev4/girder.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "3.2.16",
+  "distance": 4,
+  "node": "g6d24ab2f7bef9f253d1f040b86a7ace3d51a3077",
+  "dirty": false,
+  "branch": "3.x-maintenance",
+  "node_date": "2026-08-25"
+}

girder-3.2.16.dev8/girder.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "3.2.15",
-  "distance": 8,
-  "node": "g312583e9b9fdaa4269b7db5e907a38f283e63de3",
-  "dirty": false,
-  "branch": "3.x-maintenance",
-  "node_date": "2026-08-14"
-}