- galaxy-commits - lists.galaxyproject.org

commit/galaxy-central: jmchilton: Expose $__tool_directory__ to tools.
by commits-noreply＠bitbucket.org 03 Feb '15

03 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/ddbe0d12bc86/ Changeset: ddbe0d12bc86 User: jmchilton Date: 2015-02-03 15:29:34+00:00 Summary: Expose $__tool_directory__ to tools. Repeatedly one wants to do things like create symbolic links and then call a helper script - the 'interpreter' tag doesn't allow shell commands before calling a helper script so they could not be used in this fashion. The previous pattern for doing this was then to use the ToolShed only 'set_environment' requirement tag. These were onerous to setup and the resulting tools were no longer portable to non-ToolShed installed contexts - I believe this variant is more robust and elegant. More information https://trello.com/c/0pgF5PBQ and here https://trello.com/c/XK5SqE1i. Affected #: 5 files diff -r eb26a96483238cd353c3fc1bdce9699382dfadb6 -r ddbe0d12bc86da406bb96213e23b8ddb273ed669 lib/galaxy/jobs/__init__.py --- a/lib/galaxy/jobs/__init__.py +++ b/lib/galaxy/jobs/__init__.py @@ -1783,7 +1783,11 @@ @abstractmethod def new_file_path( self ): - """ Location to dump new files for this job on remote server. """ + """ Absolute path to dump new files for this job on compute server. """ + + @abstractmethod + def tool_directory( self ): + """ Absolute path to tool files for this job on compute server. """ @abstractmethod def version_path( self ): @@ -1836,6 +1840,9 @@ def version_path( self ): return self.job_wrapper.get_version_string_path() + def tool_directory( self ): + return os.path.abspath(self.job_wrapper.tool.tool_dir) + class NoopQueue( object ): """ diff -r eb26a96483238cd353c3fc1bdce9699382dfadb6 -r ddbe0d12bc86da406bb96213e23b8ddb273ed669 lib/galaxy/jobs/runners/pulsar.py --- a/lib/galaxy/jobs/runners/pulsar.py +++ b/lib/galaxy/jobs/runners/pulsar.py @@ -708,3 +708,6 @@ def unstructured_path_rewriter( self ): return self.rewriter + + def tool_directory( self ): + return self._tool_dir diff -r eb26a96483238cd353c3fc1bdce9699382dfadb6 -r ddbe0d12bc86da406bb96213e23b8ddb273ed669 lib/galaxy/tools/evaluation.py --- a/lib/galaxy/tools/evaluation.py +++ b/lib/galaxy/tools/evaluation.py @@ -345,6 +345,7 @@ if table_name in self.app.tool_data_tables: return self.app.tool_data_tables[ table_name ].get_entry( query_attr, query_val, return_attr ) + param_dict['__tool_directory__'] = self.compute_environment.tool_directory() param_dict['__get_data_table_entry__'] = get_data_table_entry # We add access to app here, this allows access to app.config, etc diff -r eb26a96483238cd353c3fc1bdce9699382dfadb6 -r ddbe0d12bc86da406bb96213e23b8ddb273ed669 test/functional/tools/samples_tool_conf.xml --- a/test/functional/tools/samples_tool_conf.xml +++ b/test/functional/tools/samples_tool_conf.xml @@ -32,6 +32,7 @@ <tool file="validation_repeat.xml" /><tool file="identifier_single.xml" /><tool file="identifier_multiple.xml" /> + <tool file="tool_directory.xml" /><tool file="collection_paired_test.xml" /><tool file="collection_nested_test.xml" /><tool file="collection_mixed_param.xml" /> diff -r eb26a96483238cd353c3fc1bdce9699382dfadb6 -r ddbe0d12bc86da406bb96213e23b8ddb273ed669 test/functional/tools/tool_directory.xml --- /dev/null +++ b/test/functional/tools/tool_directory.xml @@ -0,0 +1,20 @@ +<tool id="tool_directory" name="tool_directory"> + <command> + cp $__tool_directory__/tool_directory.xml output1 + </command> + <inputs> + <param type="integer" name="ignored" label="Ignored" value="0" /> + </inputs> + <outputs> + <data name="output1" type="xml" from_work_dir="output1" /> + </outputs> + <tests> + <test> + <output name="output1"> + <assert_contents> + <has_text text="QUINE" /> + </assert_contents> + </output> + </test> + </tests> +</tool> Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: carlfeberhard: Browser tests: remove starting slash from workflow return url comparisons
by commits-noreply＠bitbucket.org 03 Feb '15

03 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/eb26a9648323/ Changeset: eb26a9648323 User: carlfeberhard Date: 2015-02-03 14:00:51+00:00 Summary: Browser tests: remove starting slash from workflow return url comparisons Affected #: 1 file diff -r adcb595753b02cc9757a8f36a34898d4ea2233e7 -r eb26a96483238cd353c3fc1bdce9699382dfadb6 test/casperjs/api-workflow-tests.js --- a/test/casperjs/api-workflow-tests.js +++ b/test/casperjs/api-workflow-tests.js @@ -55,7 +55,7 @@ "uploaded workflow defaults to un-published: " + returned.published ); this.test.assert( utils.isArray( returned.tags ) && returned.tags.length === 0, "upload returned an empty tag array: " + this.jsonStr( returned.tags ) ); - this.test.assert( returned.url === '/' + utils.format( this.api.workflows.urlTpls.show, returned.id ), + this.test.assert( returned.url === utils.format( this.api.workflows.urlTpls.show, returned.id ), "url matches the show url: " + returned.url ); @@ -79,7 +79,7 @@ "workflow is un-published: " + firstWorkflow.published ); this.test.assert( utils.isArray( firstWorkflow.tags ) && firstWorkflow.tags.length === 0, "tag array is empty: " + this.jsonStr( firstWorkflow.tags ) ); - this.test.assert( firstWorkflow.url === '/' + utils.format( this.api.workflows.urlTpls.show, firstWorkflow.id ), + this.test.assert( firstWorkflow.url === utils.format( this.api.workflows.urlTpls.show, firstWorkflow.id ), "url matches the show url: " + firstWorkflow.url ); @@ -99,7 +99,7 @@ "workflow is un-published: " + workflowShow.published ); this.test.assert( utils.isArray( workflowShow.tags ) && workflowShow.tags.length === 0, "tag array is empty: " + this.jsonStr( workflowShow.tags ) ); - this.test.assert( workflowShow.url === '/' + utils.format( this.api.workflows.urlTpls.show, workflowShow.id ), + this.test.assert( workflowShow.url === utils.format( this.api.workflows.urlTpls.show, workflowShow.id ), "url matches the show url: " + workflowShow.url ); this.test.comment( 'inputs from show should be an object (and, in this case, empty)' ); Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: natefoo: Update tag latest_2015.01.13 for changeset 5e4060f5ac7a
by commits-noreply＠bitbucket.org 03 Feb '15

03 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/097bbb3b7d32/ Changeset: 097bbb3b7d32 Branch: stable User: natefoo Date: 2015-02-03 14:00:27+00:00 Summary: Update tag latest_2015.01.13 for changeset 5e4060f5ac7a Affected #: 1 file diff -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 -r 097bbb3b7d3246faaa5188a1fc2a79b01630025c .hgtags --- a/.hgtags +++ b/.hgtags @@ -22,4 +22,4 @@ 2092948937ac30ef82f71463a235c66d34987088 release_2014.10.06 782fa60fc65488aea0c618d723e9a63d42caf865 latest_2014.10.06 2e8dd2949dd3eee0f56f9a3a5ebf1b2baca24aee release_2015.01.13 -fd75aaee91cf3e8a0916689dfea72e0c752c447c latest_2015.01.13 +5e4060f5ac7a3c11d4681bc80f94c620df9d0479 latest_2015.01.13 Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: carlfeberhard: Fix to 8e5b9ca: implement _future_expose_api_anonymous_and_sessionless to allow endpoints to be access without user or session (fixes access to api/authenticate)
by commits-noreply＠bitbucket.org 02 Feb '15

02 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/adcb595753b0/ Changeset: adcb595753b0 User: carlfeberhard Date: 2015-02-02 23:57:54+00:00 Summary: Fix to 8e5b9ca: implement _future_expose_api_anonymous_and_sessionless to allow endpoints to be access without user or session (fixes access to api/authenticate) Affected #: 3 files diff -r 147c8b343d4ae09d4ae71d424037e45f06bd8e9e -r adcb595753b02cc9757a8f36a34898d4ea2233e7 lib/galaxy/web/__init__.py --- a/lib/galaxy/web/__init__.py +++ b/lib/galaxy/web/__init__.py @@ -18,6 +18,7 @@ from framework.decorators import _future_expose_api_anonymous from framework.decorators import _future_expose_api_raw from framework.decorators import _future_expose_api_raw_anonymous +from framework.decorators import _future_expose_api_anonymous_and_sessionless from framework.formbuilder import form from framework.formbuilder import FormBuilder diff -r 147c8b343d4ae09d4ae71d424037e45f06bd8e9e -r adcb595753b02cc9757a8f36a34898d4ea2233e7 lib/galaxy/web/framework/decorators.py --- a/lib/galaxy/web/framework/decorators.py +++ b/lib/galaxy/web/framework/decorators.py @@ -196,7 +196,7 @@ # ----------------------------------------------------------------------------- (new) api decorators # TODO: rename as expose_api and make default. -def _future_expose_api( func, to_json=True, user_required=True ): +def _future_expose_api( func, to_json=True, user_required=True, user_or_session_required=True ): """ Expose this function via the API. """ @@ -206,10 +206,11 @@ # TODO: Document this branch, when can this happen, # I don't understand it. return __api_error_response( trans, err_msg=trans.error_message ) + # error if user required and anon # error if anon and no session if ( ( trans.anonymous and user_required ) - or ( trans.anonymous and not trans.galaxy_session ) ): + or ( trans.anonymous and user_or_session_required and not trans.galaxy_session ) ): error_code = error_codes.USER_NO_API_KEY # Use error codes default error message. err_msg = "API authentication required for this request" @@ -325,17 +326,20 @@ return dumps( error_dict ) -# TODO: rename as expose_api and make default. def _future_expose_api_anonymous( func, to_json=True ): """ Expose this function via the API but don't require a set user. """ return _future_expose_api( func, to_json=to_json, user_required=False ) +def _future_expose_api_anonymous_and_sessionless( func, to_json=True ): + """ + Expose this function via the API but don't require a user or a galaxy_session. + """ + return _future_expose_api( func, to_json=to_json, user_required=False, user_or_session_required=False ) def _future_expose_api_raw( func ): return _future_expose_api( func, to_json=False, user_required=True ) - def _future_expose_api_raw_anonymous( func ): return _future_expose_api( func, to_json=False, user_required=False ) diff -r 147c8b343d4ae09d4ae71d424037e45f06bd8e9e -r adcb595753b02cc9757a8f36a34898d4ea2233e7 lib/galaxy/webapps/galaxy/api/authenticate.py --- a/lib/galaxy/webapps/galaxy/api/authenticate.py +++ b/lib/galaxy/webapps/galaxy/api/authenticate.py @@ -14,7 +14,7 @@ from base64 import b64decode from urllib import unquote -from galaxy.web import _future_expose_api_anonymous as expose_api_anonymous +from galaxy.web import _future_expose_api_anonymous_and_sessionless as expose_api_anonymous_and_sessionless from galaxy.managers import api_keys from galaxy import exceptions from galaxy.web.base.controller import BaseAPIController @@ -29,7 +29,7 @@ super( AuthenticationController, self ).__init__( app ) self.api_keys_manager = api_keys.ApiKeyManager( app ) - @expose_api_anonymous + @expose_api_anonymous_and_sessionless def get_api_key( self, trans, **kwd ): """ def get_api_key( self, trans, **kwd ) Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: carlfeberhard: API, folders & folder_contents: use _future_expose_api on NotImplemented routes
by commits-noreply＠bitbucket.org 02 Feb '15

02 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/147c8b343d4a/ Changeset: 147c8b343d4a User: carlfeberhard Date: 2015-02-02 23:01:44+00:00 Summary: API, folders & folder_contents: use _future_expose_api on NotImplemented routes Affected #: 3 files diff -r 1d57664c6d9c4875e5c818220fa8199cf3967de0 -r 147c8b343d4ae09d4ae71d424037e45f06bd8e9e lib/galaxy/webapps/galaxy/api/folder_contents.py --- a/lib/galaxy/webapps/galaxy/api/folder_contents.py +++ b/lib/galaxy/webapps/galaxy/api/folder_contents.py @@ -315,14 +315,14 @@ else: raise exceptions.MalformedId( 'Malformed folder id ( %s ) specified, unable to decode.' % str( encoded_folder_id ) ) - @web.expose_api + @expose_api def show( self, trans, id, library_id, **kwd ): """ GET /api/folders/{encoded_folder_id}/ """ raise exceptions.NotImplemented( 'Showing the library folder content is not implemented here.' ) - @web.expose_api + @expose_api def update( self, trans, id, library_id, payload, **kwd ): """ PUT /api/folders/{encoded_folder_id}/contents diff -r 1d57664c6d9c4875e5c818220fa8199cf3967de0 -r 147c8b343d4ae09d4ae71d424037e45f06bd8e9e lib/galaxy/webapps/galaxy/api/folders.py --- a/lib/galaxy/webapps/galaxy/api/folders.py +++ b/lib/galaxy/webapps/galaxy/api/folders.py @@ -20,7 +20,7 @@ super( FoldersController, self ).__init__( app ) self.folder_manager = folders.FolderManager() - @web.expose_api + @expose_api def index( self, trans, **kwd ): """ *GET /api/folders/ @@ -29,7 +29,7 @@ """ raise exceptions.NotImplemented( 'Listing all accessible library folders is not implemented.' ) - @web.expose_api + @expose_api def show( self, trans, id, **kwd ): """ show( self, trans, id, **kwd ) @@ -255,7 +255,7 @@ folder_dict = self.folder_manager.get_folder_dict( trans, folder ) return folder_dict - @web.expose_api + @expose_api def update( self, trans, id, library_id, payload, **kwd ): """ PUT /api/folders/{encoded_folder_id} diff -r 1d57664c6d9c4875e5c818220fa8199cf3967de0 -r 147c8b343d4ae09d4ae71d424037e45f06bd8e9e lib/galaxy/webapps/galaxy/api/library_contents.py --- a/lib/galaxy/webapps/galaxy/api/library_contents.py +++ b/lib/galaxy/webapps/galaxy/api/library_contents.py @@ -436,7 +436,7 @@ except exceptions.httpexceptions.HTTPException: raise except Exception, exc: - log.exception( 'HDA API, delete: uncaught exception: %s, %s\n%s', + log.exception( 'library_contents API, delete: uncaught exception: %s, %s\n%s', id, str( kwd ), str( exc ) ) trans.response.status = 500 rval.update({ 'error': str( exc ) }) Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: carlfeberhard: API, users: use _future_expose_api and minor clean up
by commits-noreply＠bitbucket.org 02 Feb '15

02 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/1d57664c6d9c/ Changeset: 1d57664c6d9c User: carlfeberhard Date: 2015-02-02 22:48:31+00:00 Summary: API, users: use _future_expose_api and minor clean up Affected #: 1 file diff -r 83414d1a3943a6902fe63509b07ed46cba874951 -r 1d57664c6d9c4875e5c818220fa8199cf3967de0 lib/galaxy/webapps/galaxy/api/users.py --- a/lib/galaxy/webapps/galaxy/api/users.py +++ b/lib/galaxy/webapps/galaxy/api/users.py @@ -1,23 +1,29 @@ """ API operations on User objects. """ -import logging -from paste.httpexceptions import HTTPBadRequest, HTTPNotImplemented -from galaxy import util, web, exceptions +from galaxy.web.base.controller import BaseAPIController +from galaxy.web.base.controller import UsesTagsMixin +from galaxy.web.base.controller import CreatesApiKeysMixin +from galaxy.web.base.controller import CreatesUsersMixin + from galaxy.security.validate_user_input import validate_email from galaxy.security.validate_user_input import validate_password from galaxy.security.validate_user_input import validate_publicname -from galaxy.web.base.controller import BaseAPIController, UsesTagsMixin -from galaxy.web.base.controller import CreatesApiKeysMixin -from galaxy.web.base.controller import CreatesUsersMixin +from galaxy.web import _future_expose_api as expose_api +from galaxy.web import _future_expose_api_anonymous as expose_api_anonymous +from galaxy import web +from galaxy import util +from galaxy import exceptions + +import logging log = logging.getLogger( __name__ ) class UserAPIController( BaseAPIController, UsesTagsMixin, CreatesUsersMixin, CreatesApiKeysMixin ): - @web.expose_api + @expose_api def index( self, trans, deleted='False', f_email=None, **kwd ): """ GET /api/users @@ -46,7 +52,7 @@ rval.append( item ) return rval - @web.expose_api_anonymous + @expose_api_anonymous def show( self, trans, id, deleted='False', **kwd ): """ GET /api/users/{encoded_user_id} @@ -73,30 +79,28 @@ assert trans.user == user assert not user.deleted except: - if trans.user_is_admin(): - raise - else: - raise HTTPBadRequest( detail='Invalid user id ( %s ) specified' % id ) + raise exceptions.RequestParameterInvalidException( 'Invalid user id specified', id=id ) + item = user.to_dict( view='element', value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float } ) # add a list of tags used by the user (as strings) item[ 'tags_used' ] = self.get_user_tags_used( trans, user=user ) # TODO: move into api_values (needs trans, tho - can we do that with api_keys/@property??) # TODO: works with other users (from admin)?? - item['quota_percent'] = trans.app.quota_agent.get_percent( trans=trans ) - item['is_admin'] = trans.user_is_admin() + item[ 'quota_percent' ] = trans.app.quota_agent.get_percent( trans=trans ) + item[ 'is_admin' ] = trans.user_is_admin() return item - @web.expose_api + @expose_api def create( self, trans, payload, **kwd ): """ POST /api/users Creates a new Galaxy user. """ if not trans.app.config.allow_user_creation: - raise HTTPNotImplemented( detail='User creation is not allowed in this Galaxy instance' ) + raise exceptions.ConfigDoesNotAllowException( 'User creation is not allowed in this Galaxy instance' ) if trans.app.config.use_remote_user and trans.user_is_admin(): - user = trans.get_or_create_remote_user(remote_user_email=payload['remote_user_email']) + user = trans.get_or_create_remote_user( remote_user_email=payload['remote_user_email'] ) elif trans.user_is_admin(): username = payload[ 'username' ] email = payload[ 'email' ] @@ -109,12 +113,12 @@ else: user = self.create_user( trans=trans, email=email, username=username, password=password ) else: - raise HTTPNotImplemented() + raise exceptions.NotImplemented() item = user.to_dict( view='element', value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float } ) return item - @web.expose_api + @expose_api @web.require_admin def api_key( self, trans, user_id, **kwd ): """ @@ -125,17 +129,17 @@ key = self.create_api_key( trans, user ) return key - @web.expose_api + @expose_api def update( self, trans, **kwd ): - raise HTTPNotImplemented() + raise exceptions.NotImplemented() - @web.expose_api + @expose_api def delete( self, trans, **kwd ): - raise HTTPNotImplemented() + raise exceptions.NotImplemented() - @web.expose_api + @expose_api def undelete( self, trans, **kwd ): - raise HTTPNotImplemented() + raise exceptions.NotImplemented() # TODO: move to more basal, common resource than this def anon_user_api_value( self, trans ): Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: 2 new changesets
by commits-noreply＠bitbucket.org 02 Feb '15

02 Feb '15

2 new commits in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/119898e03506/ Changeset: 119898e03506 User: carlfeberhard Date: 2015-02-02 22:08:17+00:00 Summary: API, tags & annotations: use _future_expose_api and minor clean up Affected #: 2 files diff -r 117db343f853b815b6f584679c23d0f44277c07b -r 119898e035065e3ffd1ca9b3e84f23f380faf023 lib/galaxy/webapps/galaxy/api/annotations.py --- a/lib/galaxy/webapps/galaxy/api/annotations.py +++ b/lib/galaxy/webapps/galaxy/api/annotations.py @@ -1,27 +1,31 @@ """ API operations on annotations. """ -import logging -from galaxy import web + +from galaxy.web.base.controller import BaseAPIController +from galaxy.web.base.controller import UsesStoredWorkflowMixin from galaxy.model.item_attrs import UsesAnnotations -from galaxy.util.sanitize_html import sanitize_html -from galaxy.web.base.controller import BaseAPIController, HTTPNotImplemented, UsesStoredWorkflowMixin from galaxy import managers +from galaxy import exceptions +from galaxy.web import _future_expose_api as expose_api +from galaxy.util import sanitize_html + +import logging log = logging.getLogger( __name__ ) class BaseAnnotationsController( BaseAPIController, UsesStoredWorkflowMixin, UsesAnnotations ): - @web.expose_api + @expose_api def index( self, trans, **kwd ): idnum = kwd[self.tagged_item_id] item = self._get_item_from_id(trans, idnum) if item is not None: return self.get_item_annotation_str( trans.sa_session, trans.get_user(), item ) - @web.expose_api + @expose_api def create( self, trans, payload, **kwd ): if "text" not in payload: return "" @@ -29,24 +33,24 @@ item = self._get_item_from_id(trans, idnum) if item is not None: new_annotation = payload.get("text") - # Sanitize annotation before adding it. - new_annotation = sanitize_html( new_annotation, 'utf-8', 'text/html' ) + #TODO: sanitize on display not entry + new_annotation = sanitize_html.sanitize_html( new_annotation, 'utf-8', 'text/html' ) self.add_item_annotation( trans.sa_session, trans.get_user(), item, new_annotation ) trans.sa_session.flush() return new_annotation return "" - @web.expose_api + @expose_api def delete( self, trans, **kwd ): idnum = kwd[self.tagged_item_id] item = self._get_item_from_id(trans, idnum) if item is not None: return self.delete_item_annotation( trans.sa_session, trans.get_user(), item ) - @web.expose_api + @expose_api def undelete( self, trans, **kwd ): - raise HTTPNotImplemented() + raise exceptions.NotImplemented() class HistoryAnnotationsController(BaseAnnotationsController): @@ -63,7 +67,7 @@ return history -class HistoryContentAnnotationsController(BaseAnnotationsController): +class HistoryContentAnnotationsController( BaseAnnotationsController ): controller_name = "history_content_annotations" tagged_item_id = "history_content_id" @@ -78,10 +82,10 @@ return hda -class WorkflowAnnotationsController(BaseAnnotationsController): +class WorkflowAnnotationsController( BaseAnnotationsController ): controller_name = "workflow_annotations" tagged_item_id = "workflow_id" def _get_item_from_id(self, trans, idstr): - hda = self.get_stored_workflow(trans, idstr) + hda = self.get_stored_workflow( trans, idstr ) return hda diff -r 117db343f853b815b6f584679c23d0f44277c07b -r 119898e035065e3ffd1ca9b3e84f23f380faf023 lib/galaxy/webapps/galaxy/api/item_tags.py --- a/lib/galaxy/webapps/galaxy/api/item_tags.py +++ b/lib/galaxy/webapps/galaxy/api/item_tags.py @@ -1,52 +1,55 @@ """ API operations related to tagging items. """ +from galaxy.web.base.controller import BaseAPIController +from galaxy.web.base.controller import UsesTagsMixin + +from galaxy.web import _future_expose_api as expose_api +from galaxy import exceptions + import logging -from galaxy import web -from galaxy.web.base.controller import BaseAPIController, UsesTagsMixin -from paste.httpexceptions import HTTPBadRequest - log = logging.getLogger( __name__ ) class BaseItemTagsController( BaseAPIController, UsesTagsMixin ): """ """ - @web.expose_api + @expose_api def index( self, trans, **kwd ): """ """ - tags = self._get_user_tags(trans, self.tagged_item_class, kwd[self.tagged_item_id]) + tags = self._get_user_tags(trans, self.tagged_item_class, kwd[ self.tagged_item_id ]) return [ self._api_value( tag, trans, view='collection' ) for tag in tags ] - @web.expose_api + @expose_api def show( self, trans, tag_name, **kwd ): """ """ - tag = self._get_item_tag_assoc( trans, self.tagged_item_class, kwd[self.tagged_item_id], tag_name ) + tag = self._get_item_tag_assoc( trans, self.tagged_item_class, kwd[ self.tagged_item_id ], tag_name ) if not tag: - raise HTTPBadRequest("Failed to retrieve specified tag.") + raise exceptions.ObjectNotFound( "Failed to retrieve specified tag." ) return self._api_value( tag, trans ) - @web.expose_api + @expose_api def create( self, trans, tag_name, payload=None, **kwd ): """ """ payload = payload or {} - value = payload.get("value", None) - tag = self._apply_item_tag( trans, self.tagged_item_class, kwd[self.tagged_item_id], tag_name, value ) + value = payload.get( "value", None ) + tag = self._apply_item_tag( trans, self.tagged_item_class, kwd[ self.tagged_item_id ], tag_name, value ) return self._api_value( tag, trans ) # Not handling these differently at this time update = create - @web.expose_api + @expose_api def delete( self, trans, tag_name, **kwd ): """ """ - deleted = self._remove_items_tag( trans, self.tagged_item_class, kwd[self.tagged_item_id], tag_name ) + deleted = self._remove_items_tag( trans, self.tagged_item_class, kwd[ self.tagged_item_id ], tag_name ) if not deleted: - raise HTTPBadRequest("Failed to delete specified tag.") + raise exceptions.RequestParameterInvalidException( "Failed to delete specified tag." ) + #TODO: ugh - 204 would be better return 'OK' def _api_value( self, tag, trans, view='element' ): https://bitbucket.org/galaxy/galaxy-central/commits/83414d1a3943/ Changeset: 83414d1a3943 User: carlfeberhard Date: 2015-02-02 22:09:12+00:00 Summary: Core, startup: add deprecation log.warn if using 'pack_scripts' option Affected #: 1 file diff -r 119898e035065e3ffd1ca9b3e84f23f380faf023 -r 83414d1a3943a6902fe63509b07ed46cba874951 lib/galaxy/webapps/galaxy/buildapp.py --- a/lib/galaxy/webapps/galaxy/buildapp.py +++ b/lib/galaxy/webapps/galaxy/buildapp.py @@ -90,6 +90,7 @@ webapp = wrap_in_static( webapp, global_conf, plugin_frameworks=[ app.visualizations_registry ], **kwargs ) #webapp = wrap_in_static( webapp, global_conf, plugin_frameworks=None, **kwargs ) if asbool(kwargs.get('pack_scripts', False)): + log.warn( "The 'pack_scripts' option is deprecated" ) pack_scripts() # Close any pooled database connections before forking try: Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: carlfeberhard: API, visualizations: use _future_expose_api, some clean-up
by commits-noreply＠bitbucket.org 02 Feb '15

02 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/117db343f853/ Changeset: 117db343f853 User: carlfeberhard Date: 2015-02-02 21:38:30+00:00 Summary: API, visualizations: use _future_expose_api, some clean-up Affected #: 1 file diff -r b9ec027d4b1e1b67f26632a55076dbf53e3225bd -r 117db343f853b815b6f584679c23d0f44277c07b lib/galaxy/webapps/galaxy/api/visualizations.py --- a/lib/galaxy/webapps/galaxy/api/visualizations.py +++ b/lib/galaxy/webapps/galaxy/api/visualizations.py @@ -5,68 +5,52 @@ may change often. """ -import pkg_resources -pkg_resources.require( 'SQLAlchemy >= 0.4' ) -from sqlalchemy import or_ +from galaxy.web.base.controller import BaseAPIController +from galaxy.web.base.controller import UsesVisualizationMixin +from galaxy.web.base.controller import SharableMixin +from galaxy.model.item_attrs import UsesAnnotations -from galaxy import web, util -from galaxy.web.base.controller import BaseAPIController, UsesVisualizationMixin, SharableMixin -from galaxy.model.item_attrs import UsesAnnotations -from galaxy.exceptions import ( ItemAccessibilityException, ItemDeletionException, ItemOwnershipException, - MessageException ) - -from galaxy.web import url_for +from galaxy.web import _future_expose_api as expose_api +from galaxy import web +from galaxy import util +from galaxy import exceptions import logging log = logging.getLogger( __name__ ) + class VisualizationsController( BaseAPIController, UsesVisualizationMixin, SharableMixin, UsesAnnotations ): """ RESTful controller for interactions with visualizations. """ - @web.expose_api + @expose_api def index( self, trans, **kwargs ): """ GET /api/visualizations: """ - #TODO: search for vizsesses that apply to an object (sending model class and id? - how to do this?) rval = [] - try: - if not trans.user: - raise ItemAccessibilityException( 'You must be logged in to access visualizations' ) - user = trans.user + user = trans.user - #TODO: search for: title, made by user, creation time range, type (vis name), dbkey, etc. - #TODO: limit, offset, order_by - #TODO: deleted + #TODO: search for: title, made by user, creation time range, type (vis name), dbkey, etc. + #TODO: limit, offset, order_by + #TODO: deleted - # this is the default search - user's vis, vis shared with user, published vis - visualizations = self.get_visualizations_by_user( trans, user ) - visualizations += self.get_visualizations_shared_with_user( trans, user ) - visualizations += self.get_published_visualizations( trans, exclude_user=user ) - #TODO: the admin case - everything + # this is the default search - user's vis, vis shared with user, published vis + visualizations = self.get_visualizations_by_user( trans, user ) + visualizations += self.get_visualizations_shared_with_user( trans, user ) + visualizations += self.get_published_visualizations( trans, exclude_user=user ) + #TODO: the admin case - everything - for visualization in visualizations: - item = self.get_visualization_summary_dict( visualization ) - item = trans.security.encode_dict_ids( item ) - item[ 'url' ] = web.url_for( 'visualization', id=item[ 'id' ] ) - rval.append( item ) - - except ItemAccessibilityException, exception: - trans.response.status = 403 - rval = { 'error': str( exception ) } - if trans.debug: - log.exception( str( exception ) ) - - except Exception, exception: - trans.response.status = 500 - rval = { 'error': str( exception ) } - log.exception( 'visualizations index failed: %s' %( str( exception ) ) ) + for visualization in visualizations: + item = self.get_visualization_summary_dict( visualization ) + item = trans.security.encode_dict_ids( item ) + item[ 'url' ] = web.url_for( 'visualization', id=item[ 'id' ] ) + rval.append( item ) return rval - @web.json + @expose_api def show( self, trans, id, **kwargs ): """ GET /api/visualizations/{viz_id} @@ -75,37 +59,25 @@ # the important thing is the config rval = {} #TODO:?? /api/visualizations/registry -> json of registry.listings? - try: - visualization = self.get_visualization( trans, id, check_ownership=False, check_accessible=True ) - dictionary = trans.security.encode_dict_ids( self.get_visualization_dict( visualization ) ) - dictionary[ 'url' ] = url_for( controller='visualization', - action="display_by_username_and_slug", username=visualization.user.username, slug=visualization.slug ) - dictionary[ 'annotation' ] = self.get_item_annotation_str( trans.sa_session, trans.user, visualization ) - # need to encode ids in revisions as well - encoded_revisions = [] - for revision in dictionary[ 'revisions' ]: - #NOTE: does not encode ids inside the configs - encoded_revisions.append( trans.security.encode_id( revision ) ) - dictionary[ 'revisions' ] = encoded_revisions - dictionary[ 'latest_revision' ] = trans.security.encode_dict_ids( dictionary[ 'latest_revision' ] ) + visualization = self.get_visualization( trans, id, check_ownership=False, check_accessible=True ) + dictionary = trans.security.encode_dict_ids( self.get_visualization_dict( visualization ) ) + dictionary[ 'url' ] = web.url_for( controller='visualization', + action="display_by_username_and_slug", username=visualization.user.username, slug=visualization.slug ) + dictionary[ 'annotation' ] = self.get_item_annotation_str( trans.sa_session, trans.user, visualization ) - rval = dictionary + # need to encode ids in revisions as well + encoded_revisions = [] + for revision in dictionary[ 'revisions' ]: + #NOTE: does not encode ids inside the configs + encoded_revisions.append( trans.security.encode_id( revision ) ) + dictionary[ 'revisions' ] = encoded_revisions + dictionary[ 'latest_revision' ] = trans.security.encode_dict_ids( dictionary[ 'latest_revision' ] ) - except ( ItemAccessibilityException, ItemDeletionException ), exception: - trans.response.status = 403 - rval = { 'error': str( exception ) } - if trans.debug: - log.exception( 'visualization show forbidden (%s): %s' %( id, str( exception ) ) ) - - except Exception, exception: - trans.response.status = 500 - rval = { 'error': str( exception ) } - log.exception( 'visualization show failed (%s): %s' %( id, str( exception ) ) ) - + rval = dictionary return rval - @web.expose_api + @expose_api def create( self, trans, payload, **kwargs ): """ POST /api/visualizations @@ -115,93 +87,61 @@ imports a copy of an existing visualization into the user's workspace """ rval = None - try: - if 'import_id' in payload: - import_id = payload( 'import_id' ) - visualization = self.import_visualization( trans, import_id, user=trans.user ) - else: - payload = self._validate_and_parse_payload( payload ) - # must have a type (I've taken this to be the visualization name) - if 'type' not in payload: - raise ValueError( "key/value 'type' is required" ) - vis_type = payload.pop( 'type', False ) + if 'import_id' in payload: + import_id = payload( 'import_id' ) + visualization = self.import_visualization( trans, import_id, user=trans.user ) - payload[ 'save' ] = True + else: + payload = self._validate_and_parse_payload( payload ) + # must have a type (I've taken this to be the visualization name) + if 'type' not in payload: + raise exceptions.RequestParameterMissingException( "key/value 'type' is required" ) + vis_type = payload.pop( 'type', False ) + + payload[ 'save' ] = True + try: # generate defaults - this will err if given a weird key? visualization = self.create_visualization( trans, vis_type, **payload ) + except ValueError, val_err: + raise exceptions.RequestParameterMissingException( str( val_err ) ) - rval = { 'id' : trans.security.encode_id( visualization.id ) } - - #TODO: exception boilerplate - except ( ItemAccessibilityException, ItemDeletionException ), exception: - trans.response.status = 403 - rval = { 'error': str( exception ) } - if trans.debug: - log.exception( str( exception ) ) - - except ( ValueError, AttributeError ), exception: - trans.response.status = 400 - rval = { 'error': str( exception ) } - if trans.debug: - log.exception( str( exception ) ) - - except Exception, exception: - trans.response.status = 500 - rval = { 'error': str( exception ) } - log.exception( 'creation of visualization failed: %s' %( str( exception ) ) ) + rval = { 'id' : trans.security.encode_id( visualization.id ) } return rval - @web.expose_api + @expose_api def update( self, trans, id, payload, **kwargs ): """ PUT /api/visualizations/{encoded_visualization_id} """ rval = None - try: - payload = self._validate_and_parse_payload( payload ) - # there's a differentiation here between updating the visualiztion and creating a new revision - # that needs to be handled clearly here - # or alternately, using a different controller like PUT /api/visualizations/{id}/r/{id} + payload = self._validate_and_parse_payload( payload ) - #TODO: consider allowing direct alteration of revisions title (without a new revision) - # only create a new revsion on a different config + # there's a differentiation here between updating the visualiztion and creating a new revision + # that needs to be handled clearly here + # or alternately, using a different controller like PUT /api/visualizations/{id}/r/{id} - # only update owned visualizations - visualization = self.get_visualization( trans, id, check_ownership=True ) - title = payload.get( 'title', visualization.latest_revision.title ) - dbkey = payload.get( 'dbkey', visualization.latest_revision.dbkey ) - config = payload.get( 'config', visualization.latest_revision.config ) + #TODO: consider allowing direct alteration of revisions title (without a new revision) + # only create a new revsion on a different config - latest_config = visualization.latest_revision.config - if( ( title != visualization.latest_revision.title ) - or ( dbkey != visualization.latest_revision.dbkey ) - or ( util.json.dumps( config ) != util.json.dumps( latest_config ) ) ): - revision = self.add_visualization_revision( trans, visualization, config, title, dbkey ) - rval = { 'id' : id, 'revision' : revision.id } + # only update owned visualizations + visualization = self.get_visualization( trans, id, check_ownership=True ) + title = payload.get( 'title', visualization.latest_revision.title ) + dbkey = payload.get( 'dbkey', visualization.latest_revision.dbkey ) + config = payload.get( 'config', visualization.latest_revision.config ) - # allow updating vis title - visualization.title = title - trans.sa_session.flush() + latest_config = visualization.latest_revision.config + if( ( title != visualization.latest_revision.title ) + or ( dbkey != visualization.latest_revision.dbkey ) + or ( util.json.dumps( config ) != util.json.dumps( latest_config ) ) ): + revision = self.add_visualization_revision( trans, visualization, config, title, dbkey ) + rval = { 'id' : id, 'revision' : revision.id } - except ( ItemAccessibilityException, ItemDeletionException ), exception: - trans.response.status = 403 - rval = { 'error': str( exception ) } - if trans.debug: - log.exception( str( exception ) ) - - except ( ValueError, AttributeError ), exception: - trans.response.status = 400 - rval = { 'error': str( exception ) } - if trans.debug: - log.exception( str( exception ) ) - - except Exception, exception: - trans.response.status = 500 - rval = { 'error': str( exception ) } - log.exception( 'update of visualization (%s) failed: %s' %( id, str( exception ) ) ) + # allow updating vis title + visualization.title = title + trans.sa_session.flush() return rval @@ -224,36 +164,37 @@ ) #TODO: deleted #TODO: importable + ValidationError = exceptions.RequestParameterInvalidException validated_payload = {} for key, val in payload.items(): #TODO: validate types in VALID_TYPES/registry names at the mixin/model level? if key == 'type': if not ( isinstance( val, str ) or isinstance( val, unicode ) ): - raise ValueError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) + raise ValidationError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) val = util.sanitize_html.sanitize_html( val, 'utf-8' ) elif key == 'config': if not isinstance( val, dict ): - raise ValueError( '%s must be a dictionary: %s' %( key, str( type( val ) ) ) ) + raise ValidationError( '%s must be a dictionary: %s' %( key, str( type( val ) ) ) ) elif key == 'annotation': if not ( isinstance( val, str ) or isinstance( val, unicode ) ): - raise ValueError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) + raise ValidationError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) val = util.sanitize_html.sanitize_html( val, 'utf-8' ) # these are keys that actually only be *updated* at the revision level and not here # (they are still valid for create, tho) elif key == 'title': if not ( isinstance( val, str ) or isinstance( val, unicode ) ): - raise ValueError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) + raise ValidationError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) val = util.sanitize_html.sanitize_html( val, 'utf-8' ) elif key == 'slug': if not ( isinstance( val, str ) or isinstance( val, unicode ) ): - raise ValueError( '%s must be a string: %s' %( key, str( type( val ) ) ) ) + raise ValidationError( '%s must be a string: %s' %( key, str( type( val ) ) ) ) val = util.sanitize_html.sanitize_html( val, 'utf-8' ) elif key == 'dbkey': if not ( isinstance( val, str ) or isinstance( val, unicode ) ): - raise ValueError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) + raise ValidationError( '%s must be a string or unicode: %s' %( key, str( type( val ) ) ) ) val = util.sanitize_html.sanitize_html( val, 'utf-8' ) elif key not in valid_but_uneditable_keys: @@ -262,11 +203,3 @@ validated_payload[ key ] = val return validated_payload - - #(a)web.expose_api - #def delete( self, trans, id, **kwd ): - # """ - # DELETE /api/visualizations/{encoded_history_id} - # Deletes a visualization from the database - # """ - # pass Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: jmchilton: Merged in dan/galaxy-central-prs/stable (pull request #657)
by commits-noreply＠bitbucket.org 02 Feb '15

02 Feb '15

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/5e4060f5ac7a/ Changeset: 5e4060f5ac7a Branch: stable User: jmchilton Date: 2015-02-02 21:30:49+00:00 Summary: Merged in dan/galaxy-central-prs/stable (pull request #657) [STABLE] Fix for preventing non-admins from running data managers via the api. Affected #: 4 files diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/tools/__init__.py --- a/lib/galaxy/tools/__init__.py +++ b/lib/galaxy/tools/__init__.py @@ -1388,6 +1388,12 @@ return section_id, section_name return None, None + def allow_user_access( self, user ): + """ + :returns: bool -- Whether the user is allowed to access the tool. + """ + return True + def parse( self, root, guid=None ): """ Read tool configuration from the element `root` and fill in `self`. @@ -3392,6 +3398,7 @@ self.data_manager_id = self.id def exec_after_process( self, app, inp_data, out_data, param_dict, job=None, **kwds ): + assert self.allow_user_access( job.user ), "You must be an admin to access this tool." #run original exec_after_process super( DataManagerTool, self ).exec_after_process( app, inp_data, out_data, param_dict, job=job, **kwds ) #process results of tool @@ -3415,6 +3422,7 @@ return history user = trans.user assert user, 'You must be logged in to use this tool.' + assert self.allow_user_access( user ), "You must be an admin to access this tool." history = user.data_manager_histories if not history: #create @@ -3434,6 +3442,17 @@ history = None return history + def allow_user_access( self, user ): + """ + :returns: bool -- Whether the user is allowed to access the tool. + Data Manager tools are only accessible to admins. + """ + if super( DataManagerTool, self ).allow_user_access( user ) and self.app.config.is_admin_user( user ): + return True + if user: + user = user.id + log.debug( "User (%s) attempted to access a data manager tool (%s), but is not an admin.", user, self.id ) + return False # Populate tool_type to ToolClass mappings tool_types = {} diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/tools/actions/__init__.py --- a/lib/galaxy/tools/actions/__init__.py +++ b/lib/galaxy/tools/actions/__init__.py @@ -155,6 +155,7 @@ submitting the job to the job queue. If history is not specified, use trans.history as destination for tool's output datasets. """ + assert tool.allow_user_access( trans.user ), "User (%s) is not allowed to access this tool." % ( trans.user ) # Set history. if not history: history = tool.get_default_history_by_trans( trans, create=True ) diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/webapps/galaxy/api/tools.py --- a/lib/galaxy/webapps/galaxy/api/tools.py +++ b/lib/galaxy/webapps/galaxy/api/tools.py @@ -63,7 +63,7 @@ """ io_details = util.string_as_bool( kwd.get( 'io_details', False ) ) link_details = util.string_as_bool( kwd.get( 'link_details', False ) ) - tool = self._get_tool( id ) + tool = self._get_tool( id, user=trans.user ) return tool.to_dict( trans, io_details=io_details, link_details=link_details ) @_future_expose_api_anonymous @@ -89,7 +89,7 @@ @_future_expose_api_anonymous def citations( self, trans, id, **kwds ): - tool = self._get_tool( id ) + tool = self._get_tool( id, user=trans.user ) rval = [] for citation in tool.citations: rval.append( citation.to_dict( 'bibtex' ) ) @@ -122,7 +122,7 @@ # Get tool. tool = trans.app.toolbox.get_tool( payload[ 'tool_id' ] ) if 'tool_id' in payload else None - if not tool: + if not tool or not tool.allow_user_access( trans.user ): trans.response.status = 404 return { "message": { "type": "error", "text" : trans.app.model.Dataset.conversion_messages.NO_TOOL } } @@ -212,10 +212,10 @@ # # -- Helper methods -- # - def _get_tool( self, id ): + def _get_tool( self, id, user=None ): id = urllib.unquote_plus( id ) tool = self.app.toolbox.get_tool( id ) - if not tool: + if not tool or not tool.allow_user_access( user ): raise exceptions.ObjectNotFound("Could not find tool with id '%s'" % id) return tool @@ -281,7 +281,7 @@ # original_job = self.get_hda_job( original_dataset ) tool = trans.app.toolbox.get_tool( original_job.tool_id ) - if not tool: + if not tool or not tool.allow_user_access( trans.user ): return trans.app.model.Dataset.conversion_messages.NO_TOOL tool_params = dict( [ ( p.name, p.value ) for p in original_job.parameters ] ) diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/webapps/galaxy/controllers/tool_runner.py --- a/lib/galaxy/webapps/galaxy/controllers/tool_runner.py +++ b/lib/galaxy/webapps/galaxy/controllers/tool_runner.py @@ -65,7 +65,7 @@ get_loaded_tools_by_lineage=False, set_selected=refreshed_on_change ) # No tool matching the tool id, display an error (shouldn't happen) - if not tool: + if not tool or not tool.allow_user_access( trans.user ): log.error( "index called with tool id '%s' but no such tool exists", tool_id ) trans.log_event( "Tool id '%s' does not exist" % tool_id ) trans.response.status = 404 @@ -191,6 +191,8 @@ # This is expected so not an exception. tool_id_version_message = '' error( "This dataset was created by an obsolete tool (%s). Can't re-run." % tool_id ) + if not tool.allow_user_access( trans.user ): + error( "The requested tool is unknown." ) # Can't rerun upload, external data sources, et cetera. Workflow compatible will proxy this for now if not tool.is_workflow_compatible: error( "The '%s' tool does not currently support rerunning." % tool.name ) Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: 2 new changesets
by commits-noreply＠bitbucket.org 02 Feb '15

02 Feb '15

2 new commits in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/0b9127ab708d/ Changeset: 0b9127ab708d Branch: stable User: dan Date: 2015-02-02 21:21:00+00:00 Summary: Fix for preventing non-admins from running data managers via the api. Affected #: 4 files diff -r 1b96d3a4ff28da2bd547b65ad86c5ad5a9bbfb90 -r 0b9127ab708d7d8497e80169a3b8636aea1e37c6 lib/galaxy/tools/__init__.py --- a/lib/galaxy/tools/__init__.py +++ b/lib/galaxy/tools/__init__.py @@ -1388,6 +1388,12 @@ return section_id, section_name return None, None + def allow_user_access( self, user ): + """ + :returns: bool -- Whether the user is allowed to access the tool. + """ + return True + def parse( self, root, guid=None ): """ Read tool configuration from the element `root` and fill in `self`. @@ -3392,6 +3398,7 @@ self.data_manager_id = self.id def exec_after_process( self, app, inp_data, out_data, param_dict, job=None, **kwds ): + assert self.allow_user_access( job.user ), "You must be an admin to access this tool." #run original exec_after_process super( DataManagerTool, self ).exec_after_process( app, inp_data, out_data, param_dict, job=job, **kwds ) #process results of tool @@ -3415,6 +3422,7 @@ return history user = trans.user assert user, 'You must be logged in to use this tool.' + assert self.allow_user_access( user ), "You must be an admin to access this tool." history = user.data_manager_histories if not history: #create @@ -3434,6 +3442,17 @@ history = None return history + def allow_user_access( self, user ): + """ + :returns: bool -- Whether the user is allowed to access the tool. + Data Manager tools are only accessible to admins. + """ + if super( DataManagerTool, self ).allow_user_access( user ) and self.app.config.is_admin_user( user ): + return True + if user: + user = user.id + log.debug( "User (%s) attempted to access a data manager tool (%s), but is not an admin.", user, self.id ) + return False # Populate tool_type to ToolClass mappings tool_types = {} diff -r 1b96d3a4ff28da2bd547b65ad86c5ad5a9bbfb90 -r 0b9127ab708d7d8497e80169a3b8636aea1e37c6 lib/galaxy/tools/actions/__init__.py --- a/lib/galaxy/tools/actions/__init__.py +++ b/lib/galaxy/tools/actions/__init__.py @@ -155,6 +155,7 @@ submitting the job to the job queue. If history is not specified, use trans.history as destination for tool's output datasets. """ + assert tool.allow_user_access( trans.user ), "User (%s) is not allowed to access this tool." % ( trans.user ) # Set history. if not history: history = tool.get_default_history_by_trans( trans, create=True ) diff -r 1b96d3a4ff28da2bd547b65ad86c5ad5a9bbfb90 -r 0b9127ab708d7d8497e80169a3b8636aea1e37c6 lib/galaxy/webapps/galaxy/api/tools.py --- a/lib/galaxy/webapps/galaxy/api/tools.py +++ b/lib/galaxy/webapps/galaxy/api/tools.py @@ -63,7 +63,7 @@ """ io_details = util.string_as_bool( kwd.get( 'io_details', False ) ) link_details = util.string_as_bool( kwd.get( 'link_details', False ) ) - tool = self._get_tool( id ) + tool = self._get_tool( id, user=trans.user ) return tool.to_dict( trans, io_details=io_details, link_details=link_details ) @_future_expose_api_anonymous @@ -89,7 +89,7 @@ @_future_expose_api_anonymous def citations( self, trans, id, **kwds ): - tool = self._get_tool( id ) + tool = self._get_tool( id, user=trans.user ) rval = [] for citation in tool.citations: rval.append( citation.to_dict( 'bibtex' ) ) @@ -122,7 +122,7 @@ # Get tool. tool = trans.app.toolbox.get_tool( payload[ 'tool_id' ] ) if 'tool_id' in payload else None - if not tool: + if not tool or not tool.allow_user_access( trans.user ): trans.response.status = 404 return { "message": { "type": "error", "text" : trans.app.model.Dataset.conversion_messages.NO_TOOL } } @@ -212,10 +212,10 @@ # # -- Helper methods -- # - def _get_tool( self, id ): + def _get_tool( self, id, user=None ): id = urllib.unquote_plus( id ) tool = self.app.toolbox.get_tool( id ) - if not tool: + if not tool or not tool.allow_user_access( user ): raise exceptions.ObjectNotFound("Could not find tool with id '%s'" % id) return tool @@ -281,7 +281,7 @@ # original_job = self.get_hda_job( original_dataset ) tool = trans.app.toolbox.get_tool( original_job.tool_id ) - if not tool: + if not tool or not tool.allow_user_access( trans.user ): return trans.app.model.Dataset.conversion_messages.NO_TOOL tool_params = dict( [ ( p.name, p.value ) for p in original_job.parameters ] ) diff -r 1b96d3a4ff28da2bd547b65ad86c5ad5a9bbfb90 -r 0b9127ab708d7d8497e80169a3b8636aea1e37c6 lib/galaxy/webapps/galaxy/controllers/tool_runner.py --- a/lib/galaxy/webapps/galaxy/controllers/tool_runner.py +++ b/lib/galaxy/webapps/galaxy/controllers/tool_runner.py @@ -65,7 +65,7 @@ get_loaded_tools_by_lineage=False, set_selected=refreshed_on_change ) # No tool matching the tool id, display an error (shouldn't happen) - if not tool: + if not tool or not tool.allow_user_access( trans.user ): log.error( "index called with tool id '%s' but no such tool exists", tool_id ) trans.log_event( "Tool id '%s' does not exist" % tool_id ) trans.response.status = 404 @@ -191,6 +191,8 @@ # This is expected so not an exception. tool_id_version_message = '' error( "This dataset was created by an obsolete tool (%s). Can't re-run." % tool_id ) + if not tool.allow_user_access( trans.user ): + error( "The requested tool is unknown." ) # Can't rerun upload, external data sources, et cetera. Workflow compatible will proxy this for now if not tool.is_workflow_compatible: error( "The '%s' tool does not currently support rerunning." % tool.name ) https://bitbucket.org/galaxy/galaxy-central/commits/5e4060f5ac7a/ Changeset: 5e4060f5ac7a Branch: stable User: jmchilton Date: 2015-02-02 21:30:49+00:00 Summary: Merged in dan/galaxy-central-prs/stable (pull request #657) [STABLE] Fix for preventing non-admins from running data managers via the api. Affected #: 4 files diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/tools/__init__.py --- a/lib/galaxy/tools/__init__.py +++ b/lib/galaxy/tools/__init__.py @@ -1388,6 +1388,12 @@ return section_id, section_name return None, None + def allow_user_access( self, user ): + """ + :returns: bool -- Whether the user is allowed to access the tool. + """ + return True + def parse( self, root, guid=None ): """ Read tool configuration from the element `root` and fill in `self`. @@ -3392,6 +3398,7 @@ self.data_manager_id = self.id def exec_after_process( self, app, inp_data, out_data, param_dict, job=None, **kwds ): + assert self.allow_user_access( job.user ), "You must be an admin to access this tool." #run original exec_after_process super( DataManagerTool, self ).exec_after_process( app, inp_data, out_data, param_dict, job=job, **kwds ) #process results of tool @@ -3415,6 +3422,7 @@ return history user = trans.user assert user, 'You must be logged in to use this tool.' + assert self.allow_user_access( user ), "You must be an admin to access this tool." history = user.data_manager_histories if not history: #create @@ -3434,6 +3442,17 @@ history = None return history + def allow_user_access( self, user ): + """ + :returns: bool -- Whether the user is allowed to access the tool. + Data Manager tools are only accessible to admins. + """ + if super( DataManagerTool, self ).allow_user_access( user ) and self.app.config.is_admin_user( user ): + return True + if user: + user = user.id + log.debug( "User (%s) attempted to access a data manager tool (%s), but is not an admin.", user, self.id ) + return False # Populate tool_type to ToolClass mappings tool_types = {} diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/tools/actions/__init__.py --- a/lib/galaxy/tools/actions/__init__.py +++ b/lib/galaxy/tools/actions/__init__.py @@ -155,6 +155,7 @@ submitting the job to the job queue. If history is not specified, use trans.history as destination for tool's output datasets. """ + assert tool.allow_user_access( trans.user ), "User (%s) is not allowed to access this tool." % ( trans.user ) # Set history. if not history: history = tool.get_default_history_by_trans( trans, create=True ) diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/webapps/galaxy/api/tools.py --- a/lib/galaxy/webapps/galaxy/api/tools.py +++ b/lib/galaxy/webapps/galaxy/api/tools.py @@ -63,7 +63,7 @@ """ io_details = util.string_as_bool( kwd.get( 'io_details', False ) ) link_details = util.string_as_bool( kwd.get( 'link_details', False ) ) - tool = self._get_tool( id ) + tool = self._get_tool( id, user=trans.user ) return tool.to_dict( trans, io_details=io_details, link_details=link_details ) @_future_expose_api_anonymous @@ -89,7 +89,7 @@ @_future_expose_api_anonymous def citations( self, trans, id, **kwds ): - tool = self._get_tool( id ) + tool = self._get_tool( id, user=trans.user ) rval = [] for citation in tool.citations: rval.append( citation.to_dict( 'bibtex' ) ) @@ -122,7 +122,7 @@ # Get tool. tool = trans.app.toolbox.get_tool( payload[ 'tool_id' ] ) if 'tool_id' in payload else None - if not tool: + if not tool or not tool.allow_user_access( trans.user ): trans.response.status = 404 return { "message": { "type": "error", "text" : trans.app.model.Dataset.conversion_messages.NO_TOOL } } @@ -212,10 +212,10 @@ # # -- Helper methods -- # - def _get_tool( self, id ): + def _get_tool( self, id, user=None ): id = urllib.unquote_plus( id ) tool = self.app.toolbox.get_tool( id ) - if not tool: + if not tool or not tool.allow_user_access( user ): raise exceptions.ObjectNotFound("Could not find tool with id '%s'" % id) return tool @@ -281,7 +281,7 @@ # original_job = self.get_hda_job( original_dataset ) tool = trans.app.toolbox.get_tool( original_job.tool_id ) - if not tool: + if not tool or not tool.allow_user_access( trans.user ): return trans.app.model.Dataset.conversion_messages.NO_TOOL tool_params = dict( [ ( p.name, p.value ) for p in original_job.parameters ] ) diff -r 96aabc4e66f193d4bb3b7b37d8ad4dce671f1b04 -r 5e4060f5ac7a3c11d4681bc80f94c620df9d0479 lib/galaxy/webapps/galaxy/controllers/tool_runner.py --- a/lib/galaxy/webapps/galaxy/controllers/tool_runner.py +++ b/lib/galaxy/webapps/galaxy/controllers/tool_runner.py @@ -65,7 +65,7 @@ get_loaded_tools_by_lineage=False, set_selected=refreshed_on_change ) # No tool matching the tool id, display an error (shouldn't happen) - if not tool: + if not tool or not tool.allow_user_access( trans.user ): log.error( "index called with tool id '%s' but no such tool exists", tool_id ) trans.log_event( "Tool id '%s' does not exist" % tool_id ) trans.response.status = 404 @@ -191,6 +191,8 @@ # This is expected so not an exception. tool_id_version_message = '' error( "This dataset was created by an obsolete tool (%s). Can't re-run." % tool_id ) + if not tool.allow_user_access( trans.user ): + error( "The requested tool is unknown." ) # Can't rerun upload, external data sources, et cetera. Workflow compatible will proxy this for now if not tool.is_workflow_compatible: error( "The '%s' tool does not currently support rerunning." % tool.name ) Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0