16108: Change wb1 'favorites' to filter on user_uuid instead of tail_uuid

Fixes potential exploit by which a malicious user could inject
favorites into another user's favorites list.

Public favorites owned by "All Users" will now appear in wb1.

Move documentation about 'star' links from admin section to API
documentation.

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <peter.amstutz@curii.com>

diff --git a/apps/workbench/app/controllers/actions_controller.rb b/apps/workbench/app/controllers/actions_controller.rb
index 376465ee12e09f3c6337416bfc363b0ae9e0fa18..885f539363730514a7f5dccbb1df49fb1ab2b8e0 100644 (file)
--- a/apps/workbench/app/controllers/actions_controller.rb
+++ b/apps/workbench/app/controllers/actions_controller.rb
@@ -210,7 +210,7 @@ You can try recreating the collection to get a copy with full provenance data."
 
   # star / unstar the current project
   def star
-    links = Link.where(tail_uuid: current_user.uuid,
+    links = Link.where(owner_uuid: current_user.uuid,
                        head_uuid: @object.uuid,
                        link_class: 'star')
 

diff --git a/apps/workbench/app/controllers/application_controller.rb b/apps/workbench/app/controllers/application_controller.rb
index 63112984ca957ecc52d8f7ba1315a218de977b1f..5407700615c4fb7b7125e814fa1811001a809efd 100644 (file)
--- a/apps/workbench/app/controllers/application_controller.rb
+++ b/apps/workbench/app/controllers/application_controller.rb
@@ -927,7 +927,7 @@ class ApplicationController < ActionController::Base
   helper_method :my_starred_projects
   def my_starred_projects user
     return if defined?(@starred_projects) && @starred_projects
-    links = Link.filter([['tail_uuid', '=', user.uuid],
+    links = Link.filter([['owner_uuid', 'in', ["#{Rails.configuration.ClusterID}-j7d0g-fffffffffffffff", user.uuid]],
                          ['link_class', '=', 'star'],
                          ['head_uuid', 'is_a', 'arvados#group']]).with_count("none").select(%w(head_uuid))
     uuids = links.collect { |x| x.head_uuid }

diff --git a/doc/_config.yml b/doc/_config.yml
index 814852fcc3c814792d63ea37cd9ecdcf3c254ac4..01a19c16b9186f3679a96abcb8608f83f5d170a2 100644 (file)
--- a/doc/_config.yml
+++ b/doc/_config.yml
@@ -166,7 +166,6 @@ navbar:
       - admin/health-checks.html.textile.liquid
       - admin/management-token.html.textile.liquid
     - Data Management:
-      - admin/favorites.html.textile.liquid
       - admin/collection-versioning.html.textile.liquid
       - admin/collection-managed-properties.html.textile.liquid
       - admin/keep-balance.html.textile.liquid

diff --git a/doc/admin/favorites.html.textile.liquid b/doc/admin/favorites.html.textile.liquid
deleted file mode 100644 (file)
index 623cb11..0000000
--- a/doc/admin/favorites.html.textile.liquid
+++ /dev/null
@@ -1,57 +0,0 @@
----
-layout: default
-navsection: admin
-title: Setting favorites for users
-...
-
-A "favorite" is a shortcut to a project that is displayed in the user interface (Workbench).  Users can mark their own favorites, but it is also possible to have favorites that are displayed for all members of a group (including the "All Users" group).
-
-The schema for a "favorite" link is:
-
-table(table table-bordered table-condensed).
-|_. Field|_. Value|_. Description|
-|owner_uuid|user or group uuid|The user or group that "owns" the favorite|
-|head_uuid|project uuid|The project being favorited|
-|link_class|string of value "star"|Indicates this represents a link to a user favorite|
-
-h2. Cluster wide favorites
-
-The "All Users" group for a given cluster has the uuid @{prefix}-j7d0g-ffffffffffffff@.  Cluster-wide favorites that will show up for all users should belong to the "All Users" group.
-
-Favorites can be owned by other groups, in which case they will only be visibile to members of that group.
-
-h2. Creating a favorite
-
-@owner_uuid@ controls who will see the favorite, @head_uuid@ is the project being favorited, and @link_class@ indicates this record is a favorite.  Set "tail_uuid" to the same value as "owner_uuid".
-
-<pre>
-$ arv link create --link '{
-    "owner_uuid": "c97qk-j7d0g-fffffffffffffff",
-    "tail_uuid":  "c97qk-j7d0g-fffffffffffffff",
-    "head_uuid":  "c97qk-j7d0g-khm44br99mz40hk",
-    "link_class": "star"}'
-</pre>
-
-h2. Deleting a favorite
-
-<pre>
-$ arv link delete --uuid c97qk-o0j2j-haadun4x0vmpvnd
-</pre>
-
-h2. Listing favorites
-
-To list all 'star' links readable by the current user
-
-<pre>
-$ arv link list --filters '[["link_class", "=", "star"]]' --order owner_uuid
-</pre>
-
-This will include favorites belonging any group or project that is readable by the user.
-
-Alternately, the query can be restricted to only show favorites associated with the "All Users" group (or some other group) by filtering on owner_uuid:
-
-<pre>
-$ arv link list --filters '[
-  ["link_class", "=", "star"],
-  ["owner_uuid", "=", "c97qk-j7d0g-fffffffffffffff"]]'
-</pre>

diff --git a/doc/api/methods/links.html.textile.liquid b/doc/api/methods/links.html.textile.liquid
index 04643443e680e4170df952aeb802f3dcf4eea9c7..a8eda5f03649100154940944cd582712a84f4783 100644 (file)
--- a/doc/api/methods/links.html.textile.liquid
+++ b/doc/api/methods/links.html.textile.liquid
@@ -39,9 +39,50 @@ h3. permission
 
 See "permission links":{{site.baseurl}}/api/permission-model.html#links section of the permission model.
 
+h3. star
+
+A **star** link is a shortcut to a project that is displayed in the user interface (Workbench) as "favorites".  Users can mark their own favorites (implemented by creating or deleting **star** links).
+
+An admin can also create **star** links owned by the "All Users" group, these will be displayed to all users that have permission to read the project that has been favorited.
+
+The schema for a star link is:
+
+table(table table-bordered table-condensed).
+|_. Field|_. Value|_. Description|
+|owner_uuid|user or group uuid|Either the user that owns the favorite, or the "All Users" group for public favorites.|
+|head_uuid|project uuid|The project being favorited|
+|link_class|string of value "star"|Indicates this represents a link to a user favorite|
+
+h4. Creating a favorite
+
+@owner_uuid@ is either an individual user, or the "All Users" group.  The @head_uuid@ is the project being favorited.
+
+<pre>
+$ arv link create --link '{
+    "owner_uuid": "c97qk-j7d0g-fffffffffffffff",
+    "head_uuid":  "c97qk-j7d0g-theprojectuuid",
+    "link_class": "star"}'
+</pre>
+
+h4. Deleting a favorite
+
+<pre>
+$ arv link delete --uuid c97qk-o0j2j-thestarlinkuuid
+</pre>
+
+h4. Listing favorites
+
+To list all 'star' links that will be displayed for a user:
+
+<pre>
+$ arv link list --filters '[
+  ["link_class", "=", "star"],
+  ["owner_uuid", "in", ["c97qk-j7d0g-fffffffffffffff", "c97qk-tpzed-currentuseruuid"]]]'
+</pre>
+
 h3. tag
 
-A **tag** link describes an object using an unparsed plain text string. Tags can be used to annotate objects that are not editable, like collections and objects shared as read-only.
+A **tag** link describes an object using an unparsed plain text string.  Tags can be used to annotate objects that are not directly editable by the user, like collections and objects shared as read-only.
 
 table(table table-bordered table-condensed).
 |_. tail_type&rarr;head_type|_. name&rarr;head_uuid {properties}|