From: Peter Amstutz <pamstutz@veritasgenetics.com>
Date: Wed, 24 Oct 2018 19:30:34 +0000 (-0400)
Subject: 14262: Fix logic for when to allow unknown PDH for containers
X-Git-Tag: 1.3.0~55^2~10
X-Git-Url: https://git.arvados.org/arvados.git/commitdiff_plain/dcb3218d02d977a867502d044bd5041a6e695790

14262: Fix logic for when to allow unknown PDH for containers

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>
---

diff --git a/services/api/app/models/container.rb b/services/api/app/models/container.rb
index 5d46ac29f8..e469a49bef 100644
--- a/services/api/app/models/container.rb
+++ b/services/api/app/models/container.rb
@@ -250,7 +250,7 @@ class Container < ArvadosModel
     if !coll
       if loc = Keep::Locator.parse(container_image)
         loc.strip_hints!
-        if !Collection.where(portable_data_hash: loc.to_s).any?
+        if !Collection.readable_by(current_user).where(portable_data_hash: loc.to_s).any?
           # Allow bare pdh that doesn't exist in the local database so
           # that federated container requests which refer to remotely
           # stored containers will validate.