search

EnviDat / ckanext-restricted

CKAN extension for restricting access to resources
GNU Affero General Public License v3.0
7 stars 26 forks source link

The resource link is not restricted itself. #19

Closed MandanaMoshref closed 4 years ago

MandanaMoshref commented 4 years ago

I have a strange problem in my version of the ckanext-restricted. The restriction applies to the package view, however this does not apply for the resource link itself in ckan. I mean if I go to a dataset page where a list of resources are given, for those resources with restrictions (assume I have no access to them), I need to request access. However, if I find the link of that resource (e.g. ckanwebpage.com/dataset/xxx/resource/yyyy) I can see the resource page. If that resource is a file uploaded in the system I cannot download that file but if it is a simple link to another page I can simply click and go to that page. This is however not a desirable behaviour. In fact, the ckan resource link should be blocked to unauthorized users.

espona commented 4 years ago

The behavior you suggest was the original one but it got changed at some point. It's been a while since last time I worked on this but I think there were some efficiency issues. The code is still there commented out in the file action.py . You can test it by removing the comments on the following lines: L106-L107 L122-L123 L173-L182

I hope it helps.

MandanaMoshref commented 4 years ago

Thanks espona for your prompt response. I just shortly tested your suggestion, but It doesn't change the result. Just to clarify, when I have the ckan url to the resource(access restricted resource for me) I can still see the page, although the resource link "URL" is secured (e.g. I cannot download the resource). My question is not about the URL which I have as an attribute but the ckan-page url for that resource by which one can copy it in the browser and go to the ckan webpage. Our concern is that even the metadata for a resource should be restricted so for example nobody should see the description or other attributes of the restricted resource.

But I assume this is not actually part of the code. In fact, only the direct URL is protected and not the resource totally. Am I right?

espona commented 4 years ago

Yes, you are right. Our idea was always to restrict the access to the data itself and not the metadata.

MandanaMoshref commented 4 years ago

Ok. Thanks for the clarification. I close this issue then.