From 48a360d442df134fadb732599f4ff34c70876392 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mika=C3=ABl=20Salson?= <mikael.salson@univ-lille.fr>
Date: Tue, 5 Mar 2019 16:27:17 +0000
Subject: [PATCH] controllers/default.py: checkProcess now checks permission

Fix #3733
---
 browser/js/database.js                        |  2 +-
 .../vidjil/controllers/default.py             | 23 +++++++++++++++----
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/browser/js/database.js b/browser/js/database.js
index 074b2f21b..8f8165563 100644
--- a/browser/js/database.js
+++ b/browser/js/database.js
@@ -201,7 +201,7 @@ Database.prototype = {
                  if (result.status == "COMPLETED"){
                      callback(result.data);
                  }else if(result.status == "FAILED"){
-                     console.log({"type": "flash", "msg": "process failed", "priority": 1});
+                     console.log({"type": "flash", "msg": "process failed:" + ((typeof result.message !== 'undefined') ? result.message: ''), "priority": 1});
                  }else{
                      setTimeout(function(){ self.waitProcess(processId, interval, callback); }, interval); 
                  }
diff --git a/server/web2py/applications/vidjil/controllers/default.py b/server/web2py/applications/vidjil/controllers/default.py
index e2634a6ec..606c2f4cb 100644
--- a/server/web2py/applications/vidjil/controllers/default.py
+++ b/server/web2py/applications/vidjil/controllers/default.py
@@ -172,8 +172,15 @@ def run_extra():
 
 def checkProcess():
     task = db.scheduler_task[request.vars["processId"]]
-    
-    if task.status == "COMPLETED" :
+    results_file = db(db.results_file.scheduler_task_id == task.id).select().first()
+
+    msg = ''
+    sample_set_id = -1
+    if results_file:
+        sample_set_id = get_sample_set_id_from_results_file(results_file.id)
+    if not results_file or not auth.can_view_sample_set(sample_set_id):
+        msg = "You don't have access to this sample"
+    if sample_set_id > -1 and task.status == "COMPLETED" :
         run = db( db.scheduler_run.task_id == task.id ).select()[0]
     
         res = {"success" : "true",
@@ -181,9 +188,15 @@ def checkProcess():
                "data" : run.run_result,
                "processId" : task.id}
     else :
-        res = {"success" : "true",
-               "status" : task.status,
-               "processId" : task.id}
+        if len(msg) > 0:
+            res = {"success" : "false",
+                   "status" : "FAILED",
+                   "message": msg,
+                   "processId" : task.id}
+        else:
+            res = {"success" : "true",
+                   "status" : task.status,
+                   "processId" : task.id}
         
     log.error(res)
     return gluon.contrib.simplejson.dumps(res, separators=(',',':'))
-- 
GitLab