search

EnviDat / ckanext-restricted

CKAN extension for restricting access to resources
GNU Affero General Public License v3.0
7 stars 26 forks source link

resource view still accessible #12

Closed MandanaMoshref closed 4 years ago

MandanaMoshref commented 4 years ago

Hello,

first of all many thanks for the great idea. The extension is very useful.

I have a very strange problem. I do not know whether it is me who missed some configurations or it is a bug.

I have a dataset with three resources. with the following restrictions:

I have another account with the role: "member " for Org. "A". I assume that I should be able to see the first two resources but not the third one. In the dataset page, it looks as it is expected image

However, when I click on the first resource ("SOS Client") and go down towards resources, I can simply click on the third resource and get the information. image

The only thing which is not accessible is the preview of the resource. can someone explain what is the reason and how I can resolve it?

Best regards Mani

MandanaMoshref commented 4 years ago

Ok. I figured out what the problem was. I cloned and installed the master repository. In the action.py (https://github.com/EnviDat/ckanext-restricted/blob/065a336e26090b650748a88ebe2cbda5b23afb48/ckanext/restricted/action.py#L184)

this line is missing (in my opinion):

------------------

if not authorized: restricted_resource['url'] = 'Not Authorized'

-----------------------------

When I added this line to my action.py it worked as I expected which means that it restricted the display of url link to not authorized users.

I am not sure whether my solution is right or it was the reason for my problem. However, it could be a work around solution. till it will be addressed by the developer.

Best Mani

espona commented 4 years ago

Sorry, I have almost no time assigned to this project. Regarding the url, I think it worked as you suggested in the beginning and then I was asked to change it. Anyway, if the resource is a file uploaded to CKAN, even with the URL it cannot be downloaded if the user is not authorized. I am glad you found a solution that works for you. All the best!