Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow users with only annotation access to edit annotations #1267

Merged
merged 1 commit into from
Aug 18, 2023
Merged

Allow users with only annotation access to edit annotations #1267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@
### Changes
- Adjust tifffile log level ([#1265](../../pull/1265))

### Bug Fixes
- Allow users with only annotation access to edit annotations ([#1267](../../pull/1267))

## 1.23.3

### Improvements
Expand Down
16 changes: 10 additions & 6 deletions girder_annotation/girder_large_image_annotation/rest/annotation.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,8 +334,9 @@ def updateAnnotation(self, annotation, params):
user = self.getCurrentUser()
item = Item().load(annotation.get('itemId'), force=True)
if item is not None:
Item().requireAccess(
item, user=user, level=AccessType.WRITE)
Item().hasAccessFlags(
item, user, constants.ANNOTATION_ACCESS_FLAG) or Item().requireAccess(
item, user=user, level=AccessType.WRITE)
# If we have a content length, then we have replacement JSON. If
# elements are not included, don't replace them
returnElements = True
Expand All @@ -347,8 +348,9 @@ def updateAnnotation(self, annotation, params):
returnElements = False
if params.get('itemId'):
newitem = Item().load(params['itemId'], force=True)
Item().requireAccess(
newitem, user=user, level=AccessType.WRITE)
Item().hasAccessFlags(
newitem, user, constants.ANNOTATION_ACCESS_FLAG) or Item().requireAccess(
newitem, user=user, level=AccessType.WRITE)
annotation['itemId'] = newitem['_id']
try:
annotation = Annotation().updateAnnotation(annotation, updateUser=user)
Expand All @@ -374,8 +376,10 @@ def deleteAnnotation(self, annotation, params):
# Ensure that we have write access to the parent item
item = Item().load(annotation.get('itemId'), force=True)
if item is not None:
Item().requireAccess(
item, user=self.getCurrentUser(), level=AccessType.WRITE)
user = self.getCurrentUser()
Item().hasAccessFlags(
item, user, constants.ANNOTATION_ACCESS_FLAG) or Item().requireAccess(
item, user, level=AccessType.WRITE)
setResponseTimeLimit(86400)
Annotation().remove(annotation)

Expand Down