1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/9fbe27547931/ Changeset: 9fbe27547931 User: dan Date: 2014-05-16 21:13:29 Summary: Fix for checking dataset access permissions when reruning a tool by job_id. Affected #: 1 file diff -r 1b06ee57191c56cd50c0248239f876f4c5311831 -r 9fbe2754793109a1680239131b5507614d431870 lib/galaxy/webapps/galaxy/controllers/tool_runner.py --- a/lib/galaxy/webapps/galaxy/controllers/tool_runner.py +++ b/lib/galaxy/webapps/galaxy/controllers/tool_runner.py @@ -118,6 +118,11 @@ job = trans.sa_session.query( trans.app.model.Job ).get( job_id ) except: error( "Invalid value for 'job_id' parameter" ) + if not trans.user_is_admin(): + for data_assoc in job.output_datasets: + #only allow rerunning if user is allowed access to the dataset. + if not trans.app.security_agent.can_access_dataset( trans.get_current_user_roles(), data_assoc.dataset.dataset ): + error( "You are not allowed to rerun this job" ) param_error_text = "Failed to get parameters for job id %d " % job_id else: if not id: @@ -130,7 +135,6 @@ id = trans.security.decode_id( id ) except: error( "Invalid value for 'id' parameter" ) - # Get the dataset object data = trans.sa_session.query( trans.app.model.HistoryDatasetAssociation ).get( id ) #only allow rerunning if user is allowed access to the dataset. Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.