Protect the "approve" and "reject" endpoints

Protect the actual "approve" or "reject" steps, rather than just the UI elements.
genenetwork · Jul 24, 2023 · 5930087 · 5930087
1 parent 8f9a857
commit 5930087
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/wqflask/wqflask/metadata_edits.py b/wqflask/wqflask/metadata_edits.py
@@ -655,6 +655,9 @@ def __success__(auth_details):
     ).either(__error__, __success__)
 
 @metadata_edit.route("<resource_id>/diffs/<file_name>/reject")
+@required_access(
+    ("group:resource:view-resource", "group:resource:edit-resource"),
+    trait_key="trait_name")
 @login_required(pagename="sample data rejection")
 def reject_data(resource_id: str, file_name: str):
     diffs_page = redirect(url_for("metadata_edit.list_diffs"))
@@ -679,6 +682,9 @@ def reject_data(resource_id: str, file_name: str):
     return diffs_page
 
 @metadata_edit.route("<resource_id>/diffs/<file_name>/approve")
+@required_access(
+    ("group:resource:view-resource", "group:resource:edit-resource"),
+    trait_key="trait_name")
 @login_required(pagename="Sample Data Approval")
 def approve_data(resource_id: str, file_name: str):
     from utility.tools import get_setting

diff --git a/wqflask/wqflask/templates/display_files.html b/wqflask/wqflask/templates/display_files.html
@@ -43,8 +43,8 @@ <h2>Files for approval:</h2>
                         <td><a href="{{ file_url }}" target="_blank">{{ data.meta.get("resource_id") }}</a></td>
                         <td>{{ data.meta.get("author")}}</td>
                         <td>{{ data.meta.get("time_stamp")}}</td>
-                        {% set reject_url = url_for('metadata_edit.reject_data', resource_id=data.meta.get('resource_id'), file_name=data.filepath.name) %}
-                        {% set approve_url = url_for('metadata_edit.approve_data', resource_id=data.meta.get('resource_id'), file_name=data.filepath.name) %}
+                        {% set reject_url = url_for('metadata_edit.reject_data', resource_id=data.meta.get('resource_id'), file_name=data.filepath.name, dataset_name=data.diff.dataset_name, trait_name=data.diff.trait_name) %}
+                        {% set approve_url = url_for('metadata_edit.approve_data', resource_id=data.meta.get('resource_id'), file_name=data.filepath.name, dataset_name=data.diff.dataset_name, trait_name=data.diff.trait_name) %}
                         <td>
                             <button type="button"
                                     class="btn btn-secondary btn-sm">