cBioPortal / cbioportal

cBioPortal for Cancer Genomics
https://cbioportal.org
GNU Affero General Public License v3.0
578 stars 440 forks source link

Study Summary Page Fails for Shared Virtual Study with Protected Samples #10862

Open forus opened 1 week ago

forus commented 1 week ago

When a virtual study is created using samples from a private study and shared with another user who does not have access to the original private study, the user who got the link encounters a blank content area upon accessing the virtual study.

Steps to Reproduce:

  1. User A with access to private study S1 creates a virtual study that includes samples from S1.
  2. User A shares the virtual study with User B.
  3. User B, who does not have access to private study S1, attempts to open the shared virtual study link.
  4. User B sees a blank content area. blank

The developer console shows multiple 403 Forbidden HTTP status errors for crucial requests.

The expected behavior is yet to be determined, but the page should not display as blank.

forus commented 1 week ago

This issue will likely become more common once we implement RFC83, making virtual studies available to all users.

n1zea144 commented 1 week ago

Why not the same behavior/message as what is now displayed when you somehow get a URL to a study that you don't have access to?

forus commented 1 week ago

Why not the same behavior/message as what is now displayed when you somehow get a URL to a study that you don't have access to?

That's what I see when I try to access a study I have no access to or for any non-existing stable study id.

Screenshot 2024-06-25 at 18 31 57