search

iossifovlab / gpf

GPF: Genotypes and Phenotypes in Families
MIT License
2 stars 0 forks source link

[BUG] gene sets download doesn't use authorization #322

Closed joankosev closed 1 year ago

joankosev commented 1 year ago

Gene sets can be downloaded via pasting the download request url in the browser, even when the user isn't logged. Works only for non denovo gene sets.

To reproduce: 1) open instance 2) go to genotype browser -> gene sets 3) open browser network dev tools and download whichever non denovo gene set 4) get the request url from browser network dev tools (in my case - http://localhost:8000/api/v3/gene_sets/gene_set_download?geneSetsCollection=autism&geneSet=autism+candidates+from+Iossifov+PNAS+2015&geneSetsTypes=%7B%7D) 5) log out from the instance 6) navigate to the request url

IvoTod commented 1 year ago

Only data that is accessed via datasets is protected, non-denovo gene sets can be downloaded anonymously by design. Denovo gene sets are tied to a certain study and can be accessed only if the user has permissions over the study in question.