From 4d1e9785be82d66d7735cb48a1a5342d32c3616d Mon Sep 17 00:00:00 2001 From: labkey-susanh Date: Tue, 1 Sep 2026 13:53:09 -0700 Subject: [PATCH 1/2] GH Issue 1412: Don't allow job task ids for assay types not referenced in actions --- api/src/org/labkey/api/workflow/WorkflowService.java | 2 ++ .../src/org/labkey/assay/actions/ImportRunApiAction.java | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/api/src/org/labkey/api/workflow/WorkflowService.java b/api/src/org/labkey/api/workflow/WorkflowService.java index d51bf41b381..c0150c500e3 100644 --- a/api/src/org/labkey/api/workflow/WorkflowService.java +++ b/api/src/org/labkey/api/workflow/WorkflowService.java @@ -95,6 +95,8 @@ static WorkflowService get() boolean actionWillAddSamples(Long actionId); boolean actionWillAddSources(Long actionId); + boolean isTaskAssayType(Long taskId, Long assayId); + DataIteratorBuilder getSampleCreationDataIteratorBuilder(DataIteratorBuilder data, Container container, User user); DataIteratorBuilder getSourceCreationDataIteratorBuilder(DataIteratorBuilder data, Container container, User user); diff --git a/assay/src/org/labkey/assay/actions/ImportRunApiAction.java b/assay/src/org/labkey/assay/actions/ImportRunApiAction.java index 27c31d0ea8d..8989c683162 100644 --- a/assay/src/org/labkey/assay/actions/ImportRunApiAction.java +++ b/assay/src/org/labkey/assay/actions/ImportRunApiAction.java @@ -201,6 +201,14 @@ public ApiResponse execute(ImportRunApiForm form, BindException errors) throws E auditDetailsJsonStr = form.getAuditDetails(); } + if (workflowTaskId != null) + { + WorkflowService workService = WorkflowService.get(); + + if (protocol != null && !workService.isTaskAssayType(workflowTaskId, protocol.getRowId())) + throw new ExperimentException("Invalid job task id " + workflowTaskId + ". Either the task does not exist or does not reference this assay type."); + } + if (reImportOption == null) { if (provider != null && protocol != null && provider.isPlateMetadataEnabled(protocol)) From 9b9ccbf94b7bfc17d1b223c9303ff1a91f5dc8c0 Mon Sep 17 00:00:00 2001 From: labkey-susanh Date: Tue, 1 Sep 2026 15:45:37 -0700 Subject: [PATCH 2/2] Add null check --- assay/src/org/labkey/assay/actions/ImportRunApiAction.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assay/src/org/labkey/assay/actions/ImportRunApiAction.java b/assay/src/org/labkey/assay/actions/ImportRunApiAction.java index 8989c683162..bf4eca90af6 100644 --- a/assay/src/org/labkey/assay/actions/ImportRunApiAction.java +++ b/assay/src/org/labkey/assay/actions/ImportRunApiAction.java @@ -205,7 +205,7 @@ public ApiResponse execute(ImportRunApiForm form, BindException errors) throws E { WorkflowService workService = WorkflowService.get(); - if (protocol != null && !workService.isTaskAssayType(workflowTaskId, protocol.getRowId())) + if (workService != null && protocol != null && !workService.isTaskAssayType(workflowTaskId, protocol.getRowId())) throw new ExperimentException("Invalid job task id " + workflowTaskId + ". Either the task does not exist or does not reference this assay type."); }