Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 43 additions & 43 deletions freeze.txt
Original file line number Diff line number Diff line change
Expand Up @@ -90,47 +90,47 @@ importlib-resources==5.4.0
infinity==1.4
intervals==0.8.0
invenio-access==1.1.0
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_accounts&subdirectory=modules/invenio-accounts
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_accounts&subdirectory=modules/invenio-accounts
invenio-admin==1.1.2
invenio-app==1.1.0
invenio-assets==1.0.0
invenio-base==1.0.2
invenio-cache==1.0.0
invenio-celery==1.1.3
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_communities&subdirectory=modules/invenio-communities
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_communities&subdirectory=modules/invenio-communities
invenio-config==1.0.0
invenio-csl-rest==1.0.0a1
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_db&subdirectory=modules/invenio-db
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_deposit&subdirectory=modules/invenio-deposit
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_files_rest&subdirectory=modules/invenio-files-rest
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_db&subdirectory=modules/invenio-db
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_deposit&subdirectory=modules/invenio-deposit
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_files_rest&subdirectory=modules/invenio-files-rest
invenio-formatter==1.0.0b3
invenio-i18n==1.0.0
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_iiif&subdirectory=modules/invenio-iiif
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_indexer&subdirectory=modules/invenio-indexer
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_iiif&subdirectory=modules/invenio-iiif
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_indexer&subdirectory=modules/invenio-indexer
invenio-jsonschemas==1.0.0
invenio-logging==1.0.0b3
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_mail&subdirectory=modules/invenio-mail
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_mail&subdirectory=modules/invenio-mail
invenio-marc21==1.0.0a8
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_oaiharvester&subdirectory=modules/invenio-oaiharvester
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_oaiserver&subdirectory=modules/invenio-oaiserver
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_oauth2server&subdirectory=modules/invenio-oauth2server
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_oaiharvester&subdirectory=modules/invenio-oaiharvester
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_oaiserver&subdirectory=modules/invenio-oaiserver
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_oauth2server&subdirectory=modules/invenio-oauth2server
invenio-oauthclient==1.0.0
invenio-pidrelations==1.0.0a4
invenio-pidstore==1.0.0
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_previewer&subdirectory=modules/invenio-previewer
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_previewer&subdirectory=modules/invenio-previewer
invenio-query-parser==0.6.0
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_queues&subdirectory=modules/invenio-queues
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_records&subdirectory=modules/invenio-records
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_queues&subdirectory=modules/invenio-queues
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_records&subdirectory=modules/invenio-records
invenio-records-files==1.0.0a10
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_records_rest&subdirectory=modules/invenio-records-rest
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_records_rest&subdirectory=modules/invenio-records-rest
invenio-records-ui==1.0.0
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_resourcesyncclient&subdirectory=modules/invenio-resourcesyncclient
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_resourcesyncserver&subdirectory=modules/invenio-resourcesyncserver
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_resourcesyncclient&subdirectory=modules/invenio-resourcesyncclient
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_resourcesyncserver&subdirectory=modules/invenio-resourcesyncserver
invenio-rest==1.1.2
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_s3&subdirectory=modules/invenio-s3
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_s3&subdirectory=modules/invenio-s3
-e git+https://github.com/RCOSDP/invenio-search.git@cff9744c5dc651893a9c51672c5b8da9adc21e16#egg=invenio_search
-e git+https://github.com/RCOSDP/invenio-search-ui.git@74bd3b2990ff27b39e01b6b31be9a0b5fda3dd0f#egg=invenio_search_ui
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_stats&subdirectory=modules/invenio-stats
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=invenio_stats&subdirectory=modules/invenio-stats
invenio-theme==1.0.0b4
ipaddress==1.0.19
ipython==6.2.1
Expand Down Expand Up @@ -240,30 +240,30 @@ wcwidth==0.1.7
webargs==5.5.2
webassets==0.12.1
webencodings==0.5.1
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_accounts&subdirectory=modules/weko-accounts
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_admin&subdirectory=modules/weko-admin
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_authors&subdirectory=modules/weko-authors
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_bulkupdate&subdirectory=modules/weko-bulkupdate
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_deposit&subdirectory=modules/weko-deposit
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_gridlayout&subdirectory=modules/weko-gridlayout
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_groups&subdirectory=modules/weko-groups
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_handle&subdirectory=modules/weko-handle
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_index_tree&subdirectory=modules/weko-index-tree
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_indextree_journal&subdirectory=modules/weko-indextree-journal
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_items_autofill&subdirectory=modules/weko-items-autofill
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_items_ui&subdirectory=modules/weko-items-ui
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_itemtypes_ui&subdirectory=modules/weko-itemtypes-ui
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_logging&subdirectory=modules/weko-logging
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_records&subdirectory=modules/weko-records
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_records_ui&subdirectory=modules/weko-records-ui
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_redis&subdirectory=modules/weko-redis
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_schema_ui&subdirectory=modules/weko-schema-ui
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_search_ui&subdirectory=modules/weko-search-ui
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_sitemap&subdirectory=modules/weko-sitemap
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_swordserver&subdirectory=modules/weko-swordserver
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_theme&subdirectory=modules/weko-theme
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_user_profiles&subdirectory=modules/weko-user-profiles
-e git+https://mhaya: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@github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_workflow&subdirectory=modules/weko-workflow
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_accounts&subdirectory=modules/weko-accounts
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_admin&subdirectory=modules/weko-admin
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_authors&subdirectory=modules/weko-authors
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_bulkupdate&subdirectory=modules/weko-bulkupdate
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_deposit&subdirectory=modules/weko-deposit
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_gridlayout&subdirectory=modules/weko-gridlayout
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_groups&subdirectory=modules/weko-groups
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_handle&subdirectory=modules/weko-handle
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_index_tree&subdirectory=modules/weko-index-tree
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_indextree_journal&subdirectory=modules/weko-indextree-journal
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_items_autofill&subdirectory=modules/weko-items-autofill
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_items_ui&subdirectory=modules/weko-items-ui
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_itemtypes_ui&subdirectory=modules/weko-itemtypes-ui
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_logging&subdirectory=modules/weko-logging
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_records&subdirectory=modules/weko-records
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_records_ui&subdirectory=modules/weko-records-ui
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_redis&subdirectory=modules/weko-redis
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_schema_ui&subdirectory=modules/weko-schema-ui
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_search_ui&subdirectory=modules/weko-search-ui
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_sitemap&subdirectory=modules/weko-sitemap
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_swordserver&subdirectory=modules/weko-swordserver
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_theme&subdirectory=modules/weko-theme
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_user_profiles&subdirectory=modules/weko-user-profiles
-e git+https://github.com/RCOSDP/weko.git@55eea912ab9768a0fdf4430420bf2b00eadac049#egg=weko_workflow&subdirectory=modules/weko-workflow
Werkzeug==0.15.2
whichcraft==0.4.1
WTForms==2.1
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#
# This file is part of Invenio.
# Copyright (C) 2016-2018 CERN.
#
# Invenio is free software; you can redistribute it and/or modify it
# under the terms of the MIT License; see LICENSE file for more details.

"""add column file readonly_keys"""

from alembic import op
import sqlalchemy as sa


# revision identifiers, used by Alembic.
revision = 'faf4faa08601'
down_revision = '8644b32a3eec'

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Critical · Database upgrades cannot load

When alembic loads the registered migration graph for an upgrade or downgrade, alembic cannot resolve down_revision 8644b32a3eec because no migration with that revision exists, so the migration graph fails to load and database upgrades cannot run.

Set down_revision to the actual existing parent revision for this migration.

Prompt for AI agents
In `modules/invenio-files-rest/invenio_files_rest/alembic/faf4faa08601_add_column_file_readonly_keys.py` at line 16:

**Database upgrades cannot load**

When alembic loads the registered migration graph for an upgrade or downgrade, alembic cannot resolve `down_revision` `8644b32a3eec` because no migration with that revision exists, so the migration graph fails to load and database upgrades cannot run.

Set `down_revision` to the actual existing parent revision for this migration.

branch_labels = ()
depends_on = None


def upgrade():
"""Upgrade database."""
op.add_column('files_location', sa.Column('readonly_access_key', sa.String(length=128), nullable=True))
op.add_column('files_location', sa.Column('readonly_secret_key', sa.String(length=128), nullable=True))


def downgrade():
"""Downgrade database."""
op.drop_column('files_location', 'readonly_secret_key')
op.drop_column('files_location', 'readonly_access_key')
48 changes: 27 additions & 21 deletions modules/weko-gridlayout/tests/test_views.py
Original file line number Diff line number Diff line change
Expand Up @@ -598,7 +598,9 @@ def test_delete_widget_design_page(client, users):
]
@pytest.mark.parametrize('id, status_code', user_results2)
def test_load_widget_type(client, users, id, status_code):
login_user_via_session(client=client, email=users[id]['obj'].email)
# Log in with "email": "obj" of users[4] (generaluser) is the sysadmin
# object in the users fixture.
login_user_via_session(client=client, email=users[id]['email'])
res = client.get(
url_for("weko_gridlayout_api.load_widget_type"),
headers={"Content-Type": "application/json"}
Expand Down Expand Up @@ -972,33 +974,37 @@ def test_upload_file(client, users, communities):


# def uploaded_file(filename, community_id=0):
user_results2 = [
(0, 403),
(1, 200),
(2, 200),
(3, 403),
(4, 403),
# The files are shown on the public pages, so anyone - including users who
# are not logged in - can get them.
uploaded_file_users = [
None, # not logged in
0, # Contributor
1, # Repository Administrator
2, # System Administrator
3, # Community Administrator
7, # user without any role
]
@pytest.mark.parametrize('id, status_code', user_results2)
def test_uploaded_file(client, users, id, status_code):
login_user_via_session(client=client, email=users[id]["email"])
with patch('weko_gridlayout.views.WidgetBucket.get_file', return_value="test"):
res = client.get(
url_for("weko_gridlayout.uploaded_file", community_id="Root Index", filename="file")
)
assert res.status_code == status_code
assert res.get_data(as_text=True) == "test"


def test_uploaded_file(client, communities):
@pytest.mark.parametrize('id', uploaded_file_users)
@pytest.mark.parametrize('community_id', ["Root Index", "comm1"])
def test_uploaded_file(client, users, communities, id, community_id):
if id is not None:
login_user_via_session(client=client, email=users[id]["email"])
# The view returns whatever get_file() gives it, so the stand-in has to be
# something Flask can turn into a response - a function is not.
with patch('weko_gridlayout.views.WidgetBucket.get_file', return_value="test"):
with patch('weko_gridlayout.views.WidgetBucket.get_file', return_value="test") as get_file:
res = client.get(
url_for("weko_gridlayout.uploaded_file", community_id="comm1", filename="file")
url_for("weko_gridlayout.uploaded_file", community_id=community_id, filename="file")
)
assert res.status_code == 200
assert res.get_data(as_text=True) == "test"
get_file.assert_called_once_with("file", community_id)


def test_uploaded_file_without_community(client):
with patch('weko_gridlayout.views.WidgetBucket.get_file', return_value="test") as get_file:
res = client.get("/widget/uploaded/file")
assert res.status_code == 200
get_file.assert_called_once_with("file", 0)

# def unlocked_widget():
def test_unlocked_widget(client, users):
Expand Down
7 changes: 4 additions & 3 deletions modules/weko-gridlayout/weko_gridlayout/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -611,12 +611,13 @@ def upload_file(community_id):
@blueprint.route('/widget/uploaded/<string:filename>/<string:community_id>',
methods=["GET"]
)
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])
Comment on lines -614 to -616

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 High · Private widget files are exposed

When a private or unpublished widget file exists and an unauthenticated caller knows or guesses its filename and community ID, uploaded_file() passes the request to WidgetBucket.get_file() without checking community visibility or caller access, so the caller retrieves the private file without logging in.

Restore checks for community visibility and caller authorization before serving a widget file.

Prompt for AI agents
In `modules/weko-gridlayout/weko_gridlayout/views.py` at lines 614-616:

**Private widget files are exposed**

When a private or unpublished widget file exists and an unauthenticated caller knows or guesses its filename and community ID, `uploaded_file()` passes the request to `WidgetBucket.get_file()` without checking community visibility or caller access, so the caller retrieves the private file without logging in.

Restore checks for community visibility and caller authorization before serving a widget file.

def uploaded_file(filename, community_id=0):
"""Get widget static file.

The files are embedded in widgets (e.g. images in a free description
widget) and are loaded by the browser on the public pages, so this view
must be reachable without logging in.

:param filename: file name.
:param community_id: community identifier.
:return:
Expand Down
Loading
Loading