17464: Don't deny or log GET on directories.

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <peter.amstutz@curii.com>

diff --git a/doc/admin/restricting-upload-download.html.textile.liquid b/doc/admin/restricting-upload-download.html.textile.liquid
index 45bcd8a07ae34e428e1fd5f629164024c8a6a7ec..6983e413f51c48a9a3811237c2b0ace6498801fd 100644 (file)
--- a/doc/admin/restricting-upload-download.html.textile.liquid
+++ b/doc/admin/restricting-upload-download.html.textile.liquid
@@ -39,7 +39,7 @@ Permitting @WebDAV@ makes it possible to use WebDAV, S3 API, download from Workb
 
 When a user attempts to upload or download from a service without permission, they will receive a @403 Forbidden@ response.  This only applies to file content.
 
-Denying download permission does not deny access to access to XML file listings with PROPFIND.  As a side effect it does deny auto-generated HTML documents that have file listings.
+Denying download permission does not deny access to access to XML file listings with PROPFIND, or auto-generated HTML documents containing file listings.
 
 Denying upload permission does not deny other operations that modify collections without directly accessing file content, such as MOVE and COPY.
 

diff --git a/services/keep-web/handler.go b/services/keep-web/handler.go
index 6d0b7669e3921a43f40ae6e2da370662d2ddc64a..6f6ff542b5556ff414a376f1c9c9988f0f953074 100644 (file)
--- a/services/keep-web/handler.go
+++ b/services/keep-web/handler.go
@@ -487,13 +487,14 @@ func (h *handler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        // Check configured permission
        _, sess, err := h.Config.Cache.GetSession(arv.ApiToken)
        tokenUser, err = h.Config.Cache.GetTokenUser(arv.ApiToken)
-       if !h.userPermittedToUploadOrDownload(r.Method, tokenUser) {
-               http.Error(w, "Not permitted", http.StatusForbidden)
-               return
-       }
-       h.logUploadOrDownload(r, sess.arvadosclient, nil, strings.Join(targetPath, "/"), collection, tokenUser)
 
        if webdavMethod[r.Method] {
+               if !h.userPermittedToUploadOrDownload(r.Method, tokenUser) {
+                       http.Error(w, "Not permitted", http.StatusForbidden)
+                       return
+               }
+               h.logUploadOrDownload(r, sess.arvadosclient, nil, strings.Join(targetPath, "/"), collection, tokenUser)
+
                if writeMethod[r.Method] {
                        // Save the collection only if/when all
                        // webdav->filesystem operations succeed --
@@ -548,6 +549,12 @@ func (h *handler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        } else if stat.IsDir() {
                h.serveDirectory(w, r, collection.Name, fs, openPath, true)
        } else {
+               if !h.userPermittedToUploadOrDownload(r.Method, tokenUser) {
+                       http.Error(w, "Not permitted", http.StatusForbidden)
+                       return
+               }
+               h.logUploadOrDownload(r, sess.arvadosclient, nil, strings.Join(targetPath, "/"), collection, tokenUser)
+
                http.ServeContent(w, r, basename, stat.ModTime(), f)
                if wrote := int64(w.WroteBodyBytes()); wrote != stat.Size() && w.WroteStatus() == http.StatusOK {
                        // If we wrote fewer bytes than expected, it's