Skip to content

[DicomArchive] Add project permissions to Subpage #6658

@christinerogers

Description

@christinerogers

No Project-based data access controls were added to the Subpage in this module during Data Frameworkization
As a result, a user can enter an url to download and see details on scans they should not have access to.

The ViewDetails:hasAccess() needs to be updated similar to these PRs :

Describe the bug
A clear and concise description of what the bug is

To Reproduce

  1. Go to Dicom Archive module, using a User credential that has access to project A.
  2. Click on any scan in project A to enter its View Details page
  3. Copy the URL
  4. Using another session with a user who does not have access to project A - does this URL load? Can the scans be downloaded?

for the 23 release. Modules that only have partially enforce project permissions should be updated to resolve this, if possible.

Metadata

Metadata

Assignees

Labels

Category: BugPR or issue that aims to report or fix a bugCategory: SecurityPR or issue that aims to improve securityModule: dicom_archivePR or issue related to dicom_archive module

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions