search

ome / omero-iviewer

An OMERO.web app allowing to view images
https://www.openmicroscopy.org/omero/iviewer/
Other
18 stars 29 forks source link

ROI link fails if cross-group #400

Open will-moore opened 2 years ago

will-moore commented 2 years ago

As reported at https://github.com/ome/omero-metadata/pull/62#issuecomment-1042898499 if the /iviewer/?roi=ID link refers to an ROI that is not in your default group, you get a Security Violation

/iviewer/roi/437462/image_data/ fails with:

File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero_iviewer/views.py", line 468, in roi_image_data
    roi = conn.getQueryService().get('Roi', int(obj_id))

  File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4879, in __call__
    return self.handle_exception(e, *args, **kwargs)

  File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2109, in handle_exception
    super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs)

  File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4876, in __call__
    return self.f(*args, **kwargs)

  File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero_api_IQuery_ice.py", line 322, in get
    return _M_omero.api.IQuery._op_get.invoke(self, ((klass, id), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
    serverStackTrace = ome.conditions.SecurityViolation: Cannot read ome.model.roi.Roi:Id_437462
    at ome.security.basic.BasicACLVoter.throwLoadViolation(BasicACLVoter.java:300)