Loris icon indicating copy to clipboard operation
Loris copied to clipboard

[DicomArchive] Add project permissions to Subpage

Open christinerogers opened this issue 5 years ago • 2 comments

No Project-based data access controls were added to the Subpage in this module during Data Frameworkization As a result, a user can enter an url to download and see details on scans they should not have access to.

The ViewDetails:hasAccess() needs to be updated similar to these PRs :

  • #6639 Imaging Browser
  • #6640 Electrophysiology browser

Describe the bug A clear and concise description of what the bug is

To Reproduce

  1. Go to Dicom Archive module, using a User credential that has access to project A.
  2. Click on any scan in project A to enter its View Details page
  3. Copy the URL
  4. Using another session with a user who does not have access to project A - does this URL load? Can the scans be downloaded?

for the 23 release. Modules that only have partially enforce project permissions should be updated to resolve this, if possible.

christinerogers avatar Jun 02 '20 14:06 christinerogers

@regisoc could you confirm if #8503 addressed this issue? I didn't see it in the PR description.
If it wasn't covered, let's leave this ticket open.

christinerogers avatar Sep 24 '24 15:09 christinerogers

@christinerogers not covered, it was just added in the list of related issues in #8503. It should stay opened. New PR attached, I put you as reviewer.

regisoc avatar Sep 24 '24 19:09 regisoc