X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/ea9592e911a3ccdbbbfeed8812b67e968fe1cc5f..c1e7255a85dfc2807ba78e1cf9d109d896c80b42:/services/api/app/models/arvados_model.rb diff --git a/services/api/app/models/arvados_model.rb b/services/api/app/models/arvados_model.rb index 4a717c4658..a6c9d31d41 100644 --- a/services/api/app/models/arvados_model.rb +++ b/services/api/app/models/arvados_model.rb @@ -27,7 +27,7 @@ class ArvadosModel < ActiveRecord::Base # Note: This only returns permission links. It does not account for # permissions obtained via user.is_admin or # user.uuid==object.owner_uuid. - has_many :permissions, :foreign_key => :head_uuid, :class_name => 'Link', :primary_key => :uuid, :conditions => "link_class = 'permission'", dependent: :destroy + has_many :permissions, :foreign_key => :head_uuid, :class_name => 'Link', :primary_key => :uuid, :conditions => "link_class = 'permission'" class PermissionDeniedError < StandardError def http_status @@ -187,9 +187,13 @@ class ArvadosModel < ActiveRecord::Base def ensure_owner_uuid_is_permitted raise PermissionDeniedError if !current_user - self.owner_uuid ||= current_user.uuid + if respond_to? :owner_uuid= + self.owner_uuid ||= current_user.uuid + end if self.owner_uuid_changed? - if current_user.uuid == self.owner_uuid or + if new_record? + return true + elsif current_user.uuid == self.owner_uuid or current_user.can? write: self.owner_uuid # current_user is, or has :write permission on, the new owner else