14262: Fix logic for when to allow unknown PDH for containers

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>

diff --git a/services/api/app/models/container.rb b/services/api/app/models/container.rb
index 5d46ac29f88b0079c25e2e3a6b39ec3ec52160c1..e469a49bef9d320c1ee4c26bc5f1214948d59f1c 100644 (file)
--- a/services/api/app/models/container.rb
+++ b/services/api/app/models/container.rb
@@ -250,7 +250,7 @@ class Container < ArvadosModel
     if !coll
       if loc = Keep::Locator.parse(container_image)
         loc.strip_hints!
-        if !Collection.where(portable_data_hash: loc.to_s).any?
+        if !Collection.readable_by(current_user).where(portable_data_hash: loc.to_s).any?
           # Allow bare pdh that doesn't exist in the local database so
           # that federated container requests which refer to remotely
           # stored containers will validate.