-
Notifications
You must be signed in to change notification settings - Fork 189
Closed
Labels
Category: BugPR or issue that aims to report or fix a bugPR or issue that aims to report or fix a bugCategory: SecurityPR or issue that aims to improve securityPR or issue that aims to improve securityModule: dicom_archivePR or issue related to dicom_archive modulePR or issue related to dicom_archive module
Description
No Project-based data access controls were added to the Subpage in this module during Data Frameworkization
As a result, a user can enter an url to download and see details on scans they should not have access to.
The ViewDetails:hasAccess() needs to be updated similar to these PRs :
- [electrophysiology browser] Check if user is affiliated with site when opening individual scan sessions #6639 Imaging Browser
- [electrophysiology_browser] Session page: Add Project Permissions check #6640 Electrophysiology browser
Describe the bug
A clear and concise description of what the bug is
To Reproduce
- Go to Dicom Archive module, using a User credential that has access to project A.
- Click on any scan in project A to enter its View Details page
- Copy the URL
- Using another session with a user who does not have access to project A - does this URL load? Can the scans be downloaded?
for the 23 release. Modules that only have partially enforce project permissions should be updated to resolve this, if possible.
Metadata
Metadata
Assignees
Labels
Category: BugPR or issue that aims to report or fix a bugPR or issue that aims to report or fix a bugCategory: SecurityPR or issue that aims to improve securityPR or issue that aims to improve securityModule: dicom_archivePR or issue related to dicom_archive modulePR or issue related to dicom_archive module