merge v0.13.2 release

CHANGELOG.rst

@@ -5,6 +5,37 @@ Changelog for the SODAR project. Loosely follows the
 `Keep a Changelog <http://keepachangelog.com/en/1.0.0/>`_ guidelines.
 
 
+v0.13.2 (2023-04-18)
+====================
+
+Changed
+-------
+
+- **General**
+    - Upgrade Python dependencies (#1620)
+    - Minor manual updates (#1622)
+- **Irodsbackend**
+    - Refactor ``IrodsAPI._sanitize_coll_path()`` into ``sanitize_path()`` (#1632)
+    - Handle unwanted parent strings in iRODS paths (#1632)
+- **Samplesheets**
+    - Refactor iRODS access ticket tests
+
+Fixed
+-----
+
+- **Landingzones**
+    - Zone list content with user access disabled not displayed for superuser (#1623)
+    - Incorrect "saving version failed" message in ``sheet_edit_finish`` (#1628)
+- **Samplesheets**
+    - Cell width estimation for simple links and contact columns (#1621)
+
+Removed
+-------
+
+- **Landingzones**
+    - Unused ``ProjectZoneView`` context items (#1624)
+
+
 v0.13.1 (2023-03-31)
 ====================
 

config/settings/base.py

@@ -586,7 +586,7 @@ def set_logging(level=None):
 
 
 # General API settings
-SODAR_API_DEFAULT_VERSION = '0.13.1'
+SODAR_API_DEFAULT_VERSION = '0.13.2'
 SODAR_API_ALLOWED_VERSIONS = [
     '0.7.0',
     '0.7.1',
@@ -602,6 +602,7 @@ def set_logging(level=None):
     '0.12.1',
     '0.13.0',
     '0.13.1',
+    '0.13.2',
 ]
 SODAR_API_MEDIA_TYPE = 'application/vnd.bihealth.sodar+json'
 SODAR_API_DEFAULT_HOST = env.url(

docs_manual/source/admin_install.rst

@@ -117,6 +117,7 @@ certificates can be used for evaluation and testing.
 
     $ cp yourcert.crt config/traefik/tls/server.crt
     $ cp yourcert.key config/traefik/tls/server.key
+    $ chmod +r config/traefik/tls/server.key
 
 iRODS also excepts a ``dhparams.pem`` file for Diffie-Hellman key exchange. You
 can generate the file using OpenSSL as demonstrated below.

docs_manual/source/api_documentation.rst

@@ -45,7 +45,7 @@ expected version.
 
 .. code-block:: console
 
-    Accept: application/vnd.bihealth.sodar+json; version=0.13.0
+    Accept: application/vnd.bihealth.sodar+json; version=0.13.2
 
 Specific sections of the SODAR API may require their own accept header. See the
 exact header requirement in the respective documentation on each section of the

docs_manual/source/api_examples.rst

@@ -43,7 +43,7 @@ the SODAR API:
     # Use core_headers for project management API endpoints
     core_headers = {**auth_header, 'Accept': 'application/vnd.bihealth.sodar-core+json; version=0.12.0'}
     # Use sodar_headers for sample sheet and landing zone API endpoints
-    sodar_headers = {**auth_header, 'Accept': 'application/vnd.bihealth.sodar+json; version=0.13.1'}
+    sodar_headers = {**auth_header, 'Accept': 'application/vnd.bihealth.sodar+json; version=0.13.2'}
 
 .. note::
 

docs_manual/source/api_landingzones.rst

@@ -30,4 +30,4 @@ SODAR version:
 
 .. code-block:: console
 
-    Accept: application/vnd.bihealth.sodar+json; version=0.13.1
+    Accept: application/vnd.bihealth.sodar+json; version=0.13.2

docs_manual/source/api_samplesheets.rst

@@ -30,4 +30,4 @@ SODAR version:
 
 .. code-block:: console
 
-    Accept: application/vnd.bihealth.sodar+json; version=0.13.1
+    Accept: application/vnd.bihealth.sodar+json; version=0.13.2

docs_manual/source/conf.py

@@ -26,7 +26,7 @@
 author = 'BIH Core Unit Bioinformatics'
 
 # The full version, including alpha/beta/rc tags
-release = '0.13.1'
+release = '0.13.2'
 
 
 # -- General configuration ---------------------------------------------------

docs_manual/source/dev_apps.rst

@@ -30,6 +30,24 @@ apps need to be raised and implemented in the separate
 `SODAR Core repository <https://github.com/bihealth/sodar-core>`_ and introduced
 to SODAR via the ``django-sodar-core`` dependency.
 
+
+General App Development Guidelines
+==================================
+
+This documentation assumes you are familiar in the way Django apps are set up.
+General conventions apply unless otherwise noted.
+
+SODAR apps define *plugins*. In addition to the typical Django app setup, apps
+with plugins need to be registered into the database before they can be run on
+your development site. This can be done with the following command:
+
+.. code-block:: console
+
+    $ ./manage.py syncplugins
+
+The command is also run automatically together with ``./manage.py migrate``.
+
+
 Samplesheets
 ============
 

docs_manual/source/dev_install.rst

@@ -97,6 +97,7 @@ Once generated, ensure your ``.crt`` and ``.key`` files are placed under the
 
     $ cp yourcert.crt config/traefik/tls/server.crt
     $ cp yourcert.key config/traefik/tls/server.key
+    $ chmod +r config/traefik/tls/server.key
 
 To generate the ``dhparams.pem`` file for Diffie-Hellman key exchange, you can
 use OpenSSL as demonstrated below. Ensure the file is placed under

docs_manual/source/sodar_release_notes.rst

@@ -8,6 +8,15 @@ list of changes in current and previous releases, see the
 :ref:`full changelog<sodar_changelog>`.
 
 
+v0.13.2 (2023-04-18)
+====================
+
+Maintenance and bug fix release.
+
+- Improve iRODS path validation
+- Minor updates and bug fixes
+
+
 v0.13.1 (2023-03-31)
 ====================
 

irodsbackend/api.py

@@ -36,6 +36,7 @@
 
 # SODAR constants
 PROJECT_TYPE_PROJECT = SODAR_CONSTANTS['PROJECT_TYPE_PROJECT']
+
 # Local constants
 ACCEPTED_PATH_TYPES = [
     'Assay',
@@ -53,6 +54,9 @@
     'irods_port',
 ]
 USER_GROUP_PREFIX = 'omics_project_'
+PATH_PARENT_SUBSTRING = '/..'
+ERROR_PATH_PARENT = 'Use of parent not allowed in path'
+ERROR_PATH_UNSET = 'Path is not set'
 
 
 class IrodsAPI:
@@ -130,21 +134,6 @@ def _get_query_alias(cls):
             )
         )
 
-    @classmethod
-    def _sanitize_coll_path(cls, path):
-        """
-        Return sanitized version of iRODS collection path.
-
-        :param path: iRODS collection path (string)
-        :return: String
-        """
-        if path:
-            if path[0] != '/':
-                path = '/' + path
-            if path[-1] == '/':
-                path = path[:-1]
-        return path
-
     @classmethod
     def _send_request(cls, irods, api_id, *args):
         """
@@ -198,6 +187,25 @@ def format_env(cls, env):
                 env[k] = int(env[k])
         return env
 
+    @classmethod
+    def sanitize_path(cls, path):
+        """
+        Validate and sanitize iRODS path.
+
+        :param path: iRODS collection or data object path (string)
+        :raise: ValueError if iRODS path is invalid or unacceptable
+        :return: Sanitized iRODS path (string)
+        """
+        if not path:
+            raise ValueError(ERROR_PATH_UNSET)
+        if path[0] != '/':
+            path = '/' + path
+        if PATH_PARENT_SUBSTRING in path:
+            raise ValueError(ERROR_PATH_PARENT)
+        if path[-1] == '/':
+            path = path[:-1]
+        return path
+
     @classmethod
     def get_sub_path(cls, obj, landing_zone=False, include_parent=True):
         """
@@ -368,7 +376,7 @@ def get_uuid_from_path(cls, path, obj_type):
             raise ValueError(
                 'Invalid argument for obj_type "{}"'.format(obj_type)
             )
-        s = re.search(path_regex[obj_type], cls._sanitize_coll_path(path))
+        s = re.search(path_regex[obj_type], cls.sanitize_path(path))
         if s:
             return s.group(1)
 
@@ -423,7 +431,7 @@ def get_url(
         rev_url = reverse('irodsbackend:{}'.format(view), kwargs=url_kwargs)
 
         if method == 'GET':
-            query_string = {'path': cls._sanitize_coll_path(path)}
+            query_string = {'path': cls.sanitize_path(path)}
             if view == 'list':
                 query_string['md5'] = int(md5)
                 query_string['colls'] = int(colls)
@@ -489,7 +497,7 @@ def get_object_stats(self, irods, path):
         :return: Dict
         """
         try:
-            coll = irods.collections.get(self._sanitize_coll_path(path))
+            coll = irods.collections.get(self.sanitize_path(path))
         except CollectionDoesNotExist:
             raise FileNotFoundError('iRODS collection not found')
 
@@ -655,7 +663,7 @@ def get_objects(
         :raise: FileNotFoundError if collection is not found
         """
         try:
-            coll = irods.collections.get(self._sanitize_coll_path(path))
+            coll = irods.collections.get(self.sanitize_path(path))
         except CollectionDoesNotExist:
             raise FileNotFoundError('iRODS collection not found')
 
@@ -713,7 +721,7 @@ def get_child_colls(cls, irods, path):
         :return: List
         """
         try:
-            coll = irods.collections.get(cls._sanitize_coll_path(path))
+            coll = irods.collections.get(cls.sanitize_path(path))
             return coll.subcollections
         except CollectionDoesNotExist:
             return []
@@ -748,7 +756,7 @@ def issue_ticket(
         :return: irods client Ticket object
         """
         ticket = Ticket(irods, ticket=ticket_str)
-        ticket.issue(mode, self._sanitize_coll_path(path))
+        ticket.issue(mode, self.sanitize_path(path))
         # Remove default file writing limitation
         self._send_request(
             irods,

irodsbackend/tests/test_api.py

@@ -15,7 +15,12 @@
 # Landingzones dependency
 from landingzones.tests.test_models import LandingZoneMixin
 
-from irodsbackend.api import IrodsAPI, USER_GROUP_PREFIX
+from irodsbackend.api import (
+    IrodsAPI,
+    USER_GROUP_PREFIX,
+    ERROR_PATH_PARENT,
+    ERROR_PATH_UNSET,
+)
 
 
 # Global constants
@@ -111,6 +116,26 @@ def test_format_env(self):
         self.assertEqual(env['irods_encryption_salt_size'], 8)
         self.assertEqual(env['irods_port'], 1247)
 
+    def test_sanitize_path(self):
+        """Test sanitize_path()"""
+        self.assertEqual(
+            self.irods_backend.sanitize_path('/sodarZone/projects'),
+            '/sodarZone/projects',
+        )
+        self.assertEqual(
+            self.irods_backend.sanitize_path('sodarZone/projects/'),
+            '/sodarZone/projects',
+        )
+        with self.assertRaises(ValueError) as ex:
+            self.irods_backend.sanitize_path('')
+            self.assertEqual(ex, ERROR_PATH_UNSET)
+        with self.assertRaises(ValueError) as ex:
+            self.irods_backend.sanitize_path('/sodarZone/projects/..')
+            self.assertEqual(ex, ERROR_PATH_PARENT)
+        with self.assertRaises(ValueError) as ex:
+            self.irods_backend.sanitize_path('../home')
+            self.assertEqual(ex, ERROR_PATH_PARENT)
+
     def test_get_path_project(self):
         """Test get_irods_path() with a Project object"""
         expected = '/{zone}/projects/{uuid_prefix}/{uuid}'.format(