15159: Hide "open in new tab" if unsafe and TrustAllContent is false

Arvados-DCO-1.1-Signed-off-by: Stephen Smith <stephen@curii.com>

diff --git a/src/common/config.ts b/src/common/config.ts
index 28d4855b47ea7f51c5f702d026fb86edaeb258dd..56f7c4884b19542ee057b937b5ff420809477a9e 100644 (file)
--- a/src/common/config.ts
+++ b/src/common/config.ts
@@ -89,7 +89,8 @@ export interface ClusterConfigJSON {
                 Value: string,
                 Protected?: boolean,
             }
-        }
+        },
+        TrustAllContent: boolean
     };
     Volumes: {
         [key: string]: {
@@ -271,6 +272,7 @@ export const mockClusterConfigJSON = (config: Partial<ClusterConfigJSON>): Clust
     },
     Collections: {
         ForwardSlashNameSubstitution: "",
+        TrustAllContent: false,
     },
     Volumes: {},
     ...config

diff --git a/src/views-components/context-menu/actions/collection-file-viewer-action.tsx b/src/views-components/context-menu/actions/collection-file-viewer-action.tsx
index 27a6501876d7185731847005cd1beb6fb888bfd3..f736f0bf2705bf8d3481eb974cfdb93a3a1cc23f 100644 (file)
--- a/src/views-components/context-menu/actions/collection-file-viewer-action.tsx
+++ b/src/views-components/context-menu/actions/collection-file-viewer-action.tsx
@@ -7,7 +7,7 @@ import { RootState } from "../../../store/store";
 import { FileViewerAction } from 'views-components/context-menu/actions/file-viewer-action';
 import { getNodeValue } from "models/tree";
 import { ContextMenuKind } from 'views-components/context-menu/context-menu';
-import { getInlineFileUrl, sanitizeToken } from "./helpers";
+import { getInlineFileUrl, sanitizeToken, isInlineFileUrlSafe } from "./helpers";
 
 const mapStateToProps = (state: RootState) => {
     const { resource } = state.contextMenu;
@@ -18,7 +18,12 @@ const mapStateToProps = (state: RootState) => {
         ContextMenuKind.COLLECTION_DIRECTORY_ITEM,
         ContextMenuKind.READONLY_COLLECTION_DIRECTORY_ITEM ].indexOf(resource.menuKind as ContextMenuKind) > -1) {
         const file = getNodeValue(resource.uuid)(state.collectionPanelFiles);
-        if (file) {
+        const shouldShowInlineUrl = isInlineFileUrlSafe(
+                                file ? file.url : "",
+                                state.auth.config.keepWebServiceUrl,
+                                state.auth.config.keepWebInlineServiceUrl
+                              ) || state.auth.config.clusterConfig.Collections.TrustAllContent;
+        if (file && shouldShowInlineUrl) {
             const fileUrl = sanitizeToken(getInlineFileUrl(
                 file.url,
                 state.auth.config.keepWebServiceUrl,

diff --git a/src/views-components/context-menu/actions/helpers.ts b/src/views-components/context-menu/actions/helpers.ts
index dfa8d04f1d83124b27283efa857403936329bd83..159b1c189737be75fd5c942792513c31b1f54204 100644 (file)
--- a/src/views-components/context-menu/actions/helpers.ts
+++ b/src/views-components/context-menu/actions/helpers.ts
@@ -43,4 +43,11 @@ export const getInlineFileUrl = (url: string, keepWebSvcUrl: string, keepWebInli
         inlineUrl = inlineUrl.replace(`/c=${collMatch[1]}`, '');
     }
     return inlineUrl;
-};
\ No newline at end of file
+};
+
+export const isInlineFileUrlSafe = (url: string, keepWebSvcUrl: string, keepWebInlineSvcUrl: string): boolean => {
+  let inlineUrl = keepWebInlineSvcUrl !== ""
+      ? url.replace(keepWebSvcUrl, keepWebInlineSvcUrl)
+      : url;
+  return inlineUrl.indexOf('*.') > -1;
+}

diff --git a/tools/arvados_config.yml b/tools/arvados_config.yml
index 3fcd61194b3c2635287ebc0fe07bb0754dddc773..369046e68c0e2ff04a458c992faa472bab88b821 100644 (file)
--- a/tools/arvados_config.yml
+++ b/tools/arvados_config.yml
@@ -10,7 +10,7 @@ Clusters:
       CollectionVersioning: true
       PreserveVersionIfIdle: -1s
       BlobSigningKey: zfhgfenhffzltr9dixws36j1yhksjoll2grmku38mi7yxd66h5j4q9w4jzanezacp8s6q0ro3hxakfye02152hncy6zml2ed0uc
-      TrustAllContent: true
+      TrustAllContent: false
       ForwardSlashNameSubstitution: /
       ManagedProperties:
         original_owner_uuid: {Function: original_owner, Protected: true}