Allow Preview User to download files without requiring a Guestbook Re… - #12584
Allow Preview User to download files without requiring a Guestbook Re…#12584stevenwinship wants to merge 5 commits into
Conversation
github-actions
Bot
added
FY27 Sprint 1
|
This PR replaces #12548 |
| Dataset d = df.getOwner(); | ||
| boolean required = df.getOwner().hasEnabledGuestbook() && !d.getEffectiveGuestbookEntryAtRequest(); | ||
| Dataset ds = df.getOwner(); | ||
| boolean required = ds.hasEnabledGuestbook() && !ds.getEffectiveGuestbookEntryAtRequest() && !(user instanceof PrivateUrlUser); |
There was a problem hiding this comment.
I think this skips checking if the PrivateUrlUser has access to this dataset?
There was a problem hiding this comment.
That happens in checkAuthorization which is called before checkGuestbookRequiredResponse
There was a problem hiding this comment.
OK - fair. I'd suggest moving this down so required is just about the guestbooks and then, in your if (required) block, handle the PreviewUrlUser and Authenticated user separately with a note - PreviewUrlUsers don't need another check because they can only be downloading because they have the ViewUnpublished perm whereas authenticatedUsers who can download may have that perm or FileDownload perm, so need to distinguish those two cases here.
| if (required) { | ||
| User requestor = getRequestor(user); | ||
| if (requestor instanceof AuthenticatedUser && permissionService.userOn(requestor, df.getOwner()).has(Permission.EditDataset)) { | ||
| if (user instanceof AuthenticatedUser && permissionService.userOn(user, ds).has(Permission.EditDataset)) { |
There was a problem hiding this comment.
Versus if you change here to drop the instanceof AuthenticatedUser part, this permissionService check should verify the PrivateUrlUser has an assignment on this dataset. (And this would be the perm I suggested might be ViewUnpublishedDataset to match the overall access check.)
There was a problem hiding this comment.
changed to ViewUnpublishedDataset
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
coverage: 24.972% (+0.002%) from 24.97% — 12535-download-without-guestbook-response-for-preview-user2 into develop |
This comment has been minimized.
This comment has been minimized.
1 similar comment
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
|
📦 Pushed preview images as 🚢 See on GHCR. Use by referencing with full name as printed above, mind the registry name. |
4 participants
The guestbook popup does not appear to collect a response before the download attempt is made. Disabling the guestbook on the dataset resolves the issue and files download normally through the Preview URL. This fix reinstates the behavior of the JSF UI from prior versions of Dataverse.
Which issue(s) this PR closes:#12535
Closes #12535
Special notes for your reviewer:
Suggestions on how to test this: Create a dataset with a guestbook. Generate a Preview URL. Using the preview url try to download files and dataset zip file. This should work without requiring the guestbook response.
Does this PR introduce a user interface change? If mockups are available, please link/include them here:
Is there a release notes update needed for this change?: Included
Additional documentation: