girder 5.0.17.dev14__tar.gz → 5.0.17.dev18__tar.gz

{girder-5.0.17.dev14 → girder-5.0.17.dev18}/.circleci/config.yml

@@ -105,6 +105,9 @@ jobs:
           name: Test public symbols
           command: tox -e public-names
           working_directory: girder
+      - store_artifacts:
+          path: girder/build/docs
+          destination: docs
 
   server-pytest-test:
     # We need the machine executor here because of slicer_cli_web E2E tests that require docker

{girder-5.0.17.dev14 → girder-5.0.17.dev18}/.readthedocs.yml

@@ -8,7 +8,6 @@ build:
 sphinx:
   configuration: docs/conf.py
   fail_on_warning: true
-  output: build/docs/html
 
 python:
   install:

{girder-5.0.17.dev14/girder.egg-info → girder-5.0.17.dev18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 5.0.17.dev14
+Version: 5.0.17.dev18
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

{girder-5.0.17.dev14 → girder-5.0.17.dev18}/girder/models/model_base.py

@@ -48,12 +48,18 @@ def _permissionClauses(user=None, level=None, prefix=''):
     :returns: A query dictionary with an '$or' entry which consists of a list
         of match clauses, any one of which implies validation.
     """
+    from girder.models.setting import Setting
+    from girder.settings import SettingKey
+
     permissionClauses = []
     if level is None or (user and user['admin']):
         # Without a level or with an admin user, match everything.
         return {}
     if level <= AccessType.READ:
-        permissionClauses.append({prefix + 'public': True})
+        if user or not Setting().get(SettingKey.DISABLE_ANONYMOUS_ACCESS):
+            permissionClauses.append({prefix + 'public': True})
+        else:
+            return {'__matchnothing': 'nothing'}
     elif not user:
         # If we have no user and asked for higher than read access, make a
         # query that will fail
@@ -1215,9 +1221,12 @@ class AccessControlledModel(Model):
         """
         if user is None:
             if doc.get('public', False):
-                return AccessType.READ
-            else:
-                return AccessType.NONE
+                from girder.models.setting import Setting
+                from girder.settings import SettingKey
+
+                if not Setting().get(SettingKey.DISABLE_ANONYMOUS_ACCESS):
+                    return AccessType.READ
+            return AccessType.NONE
         elif user['admin']:
             return AccessType.ADMIN
         else:
@@ -1367,8 +1376,14 @@ class AccessControlledModel(Model):
         :returns: Whether the access is granted.
         """
         if level <= AccessType.READ and doc.get('public', False) is True:
-            # Short-circuit the case of public resources
-            return True
+            from girder.models.setting import Setting
+            from girder.settings import SettingKey
+
+            if user is not None or not Setting().get(SettingKey.DISABLE_ANONYMOUS_ACCESS):
+                # Short-circuit the case of public resources
+                return True
+            elif user is None:
+                return False
         elif user is None:
             # Anonymous users can only see public resources
             return False

{girder-5.0.17.dev14 → girder-5.0.17.dev18}/girder/settings.py

@@ -32,6 +32,7 @@ class SettingKey:
     EMAIL_HOST = 'core.email_host'
     EMAIL_VERIFICATION = 'core.email_verification'
     ENABLE_PASSWORD_LOGIN = 'core.enable_password_login'
+    DISABLE_ANONYMOUS_ACCESS = 'core.disable_anonymous_access'
     FILEHANDLE_MAX_SIZE = 'core.filehandle_max_size'
     GIRDER_MOUNT_INFORMATION = 'core.girder_mount_information'
     PRIVACY_NOTICE = 'core.privacy_notice'
@@ -82,6 +83,7 @@ class SettingDefault:
         # SettingKey.EMAIL_HOST is provided by a function
         SettingKey.EMAIL_VERIFICATION: 'disabled',
         SettingKey.ENABLE_PASSWORD_LOGIN: True,
+        SettingKey.DISABLE_ANONYMOUS_ACCESS: False,
         SettingKey.FILEHANDLE_MAX_SIZE: 1024 * 1024 * 16,
         SettingKey.GIRDER_MOUNT_INFORMATION: None,
         SettingKey.PRIVACY_NOTICE: 'https://www.kitware.com/privacy',
@@ -269,6 +271,12 @@ class SettingValidator:
         if not isinstance(doc['value'], bool):
             raise ValidationException('Enable password login setting must be boolean.', 'value')
 
+    @staticmethod
+    @setting_utilities.validator(SettingKey.DISABLE_ANONYMOUS_ACCESS)
+    def _validateDisableAnonymousAccess(doc):
+        if not isinstance(doc['value'], bool):
+            raise ValidationException('Disable anonymous access setting must be boolean.', 'value')
+
     @staticmethod
     @setting_utilities.validator(SettingKey.FILEHANDLE_MAX_SIZE)
     def _validateFilehandleMaxSize(doc):