2044: Ensure users can only give permission links to unreadable users.

diff --git a/services/api/app/models/link.rb b/services/api/app/models/link.rb
index 485246160599f0fc8c0a9979ea98f2ef351e2483..6321145045fe2443206bcf67e2a8a035c11c2921 100644 (file)
--- a/services/api/app/models/link.rb
+++ b/services/api/app/models/link.rb
@@ -108,7 +108,8 @@ class Link < ArvadosModel
   # A user can give all other users permissions on folders.
   def skip_uuid_read_permission_check
     skipped_attrs = super
-    if (ArvadosModel.resource_class_for_uuid(head_uuid) == Group) and
+    if link_class == "permission" and
+        (ArvadosModel.resource_class_for_uuid(head_uuid) == Group) and
         (ArvadosModel.resource_class_for_uuid(tail_uuid) == User)
       skipped_attrs << "tail_uuid"
     end

diff --git a/services/api/test/unit/link_test.rb b/services/api/test/unit/link_test.rb
index 5bd8038ac1fe5fc247f8d9c6c9b4437c13f11d41..842368365a77a5e400503d2f2e574f7a31d2b595 100644 (file)
--- a/services/api/test/unit/link_test.rb
+++ b/services/api/test/unit/link_test.rb
@@ -82,6 +82,30 @@ class LinkTest < ActiveSupport::TestCase
     refute link.valid?
   end
 
+  test "user can't add a Collection to a Project without permission" do
+    link = make_active_perm(link_class: "name",
+                            name: "Permission denied test name",
+                            tail_uuid: collections(:bar_file).uuid)
+    begin
+      refute link.valid?
+    rescue ArvadosModel::PermissionDeniedError
+      # That's good enough.
+    end
+  end
+
+  test "user can't add a User to a Project" do
+    # Users *can* give other users permissions to projects.
+    # This test helps ensure that that exception is specific to permissions.
+    link = make_active_perm(link_class: "name",
+                            name: "Permission denied test name",
+                            tail_uuid: users(:admin).uuid)
+    begin
+      refute link.valid?
+    rescue ArvadosModel::PermissionDeniedError => e
+      # That's good enough.
+    end
+  end
+
   test "link granting project permissions to unreadable user is valid" do
     link = make_active_perm(tail_uuid: users(:admin).uuid)
     assert link.valid?