girder 5.0.17.dev2__tar.gz → 5.0.17.dev6__tar.gz

{girder-5.0.17.dev2/girder.egg-info → girder-5.0.17.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 5.0.17.dev2
+Version: 5.0.17.dev6
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

{girder-5.0.17.dev2 → girder-5.0.17.dev6}/girder/api/v1/folder.py

@@ -431,4 +431,4 @@ class Folder(Resource):
         .errorResponse('Read access was denied for the folder.', 403)
     )
     def rootpath(self, folder, params):
-        return self._model.parentsToRoot(folder, user=self.getCurrentUser())
+        return self._model.parentsToRoot(folder, user=self.getCurrentUser(), hideInaccessible=True)

{girder-5.0.17.dev2 → girder-5.0.17.dev6}/girder/api/v1/item.py

@@ -314,7 +314,7 @@ class Item(Resource):
         .errorResponse('Read access was denied for the item.', 403)
     )
     def rootpath(self, item):
-        return self._model.parentsToRoot(item, self.getCurrentUser())
+        return self._model.parentsToRoot(item, self.getCurrentUser(), hideInaccessible=True)
 
     @access.user(scope=TokenScope.DATA_WRITE)
     @filtermodel(model=ItemModel)

{girder-5.0.17.dev2 → girder-5.0.17.dev6}/girder/models/folder.py

@@ -564,7 +564,15 @@ class Folder(AccessControlledModel):
 
         return filteredDoc
 
-    def parentsToRoot(self, folder, curPath=None, user=None, force=False, level=AccessType.READ):
+    def parentsToRoot(
+        self,
+        folder,
+        curPath=None,
+        user=None,
+        force=False,
+        level=AccessType.READ,
+        hideInaccessible=False,
+    ):
         """
         Get the path to traverse to a root of the hierarchy.
 
@@ -572,6 +580,7 @@ class Folder(AccessControlledModel):
         :type folder: dict
         :returns: an ordered list of dictionaries from root to the current folder
         """
+        force = force or hideInaccessible
         curPath = curPath or []
         curParentId = folder['parentId']
         curParentType = folder['parentCollection']
@@ -585,10 +594,30 @@ class Folder(AccessControlledModel):
             else:
                 parentFiltered = ModelImporter.model(curParentType).filter(curParentObject, user)
 
-            return [{
+            curPaths = [{
                 'type': curParentType,
                 'object': parentFiltered
             }] + curPath
+            if hideInaccessible:
+                consolidatedPaths = []
+                # Walk the hierarchy from root to leaf, and return only the objects
+                # that the user has access to, providing they don't leak any parent
+                # information to the client.
+                for path in curPaths:
+                    pathModel = ModelImporter.model(path['type'])
+                    if not pathModel.hasAccess(path['object'], user, level):
+                        # If the user does not have access to a folder/collection/user,
+                        # discard all the accumulated hierarchy so as to not leak any
+                        # relational information.
+                        consolidatedPaths = []
+                        continue
+                    consolidatedPaths.append({
+                        'type': path['type'],
+                        'object': pathModel.filter(path['object'], user)
+                    })
+
+                return consolidatedPaths
+            return curPaths
         else:
             curParentObject = self.load(curParentId, user=user, level=level, force=force)
             curPath = [{
@@ -596,7 +625,13 @@ class Folder(AccessControlledModel):
                 'object': curParentObject if force else self.filter(curParentObject, user)
             }] + curPath
 
-            return self.parentsToRoot(curParentObject, curPath, user=user, force=force)
+            return self.parentsToRoot(
+                curParentObject,
+                curPath,
+                user=user,
+                force=force,
+                hideInaccessible=hideInaccessible
+            )
 
     def countItems(self, folder):
         """

{girder-5.0.17.dev2 → girder-5.0.17.dev6}/girder/models/item.py

@@ -380,7 +380,7 @@ class Item(acl_mixin.AccessControlMixin, Model):
 
         return self.save(item)
 
-    def parentsToRoot(self, item, user=None, force=False):
+    def parentsToRoot(self, item, user=None, force=False, hideInaccessible=False):
         """
         Get the path to traverse to a root of the hierarchy.
 
@@ -399,7 +399,12 @@ class Item(acl_mixin.AccessControlMixin, Model):
         curFolder = folderModel.load(
             item['folderId'], user=user, level=AccessType.READ, force=force)
         folderIdsToRoot = folderModel.parentsToRoot(
-            curFolder, user=user, level=AccessType.READ, force=force)
+            curFolder,
+            user=user,
+            level=AccessType.READ,
+            force=force,
+            hideInaccessible=hideInaccessible,
+        )
 
         if force:
             folderIdsToRoot.append({'type': 'folder', 'object': curFolder})