Opened 7 years ago

Closed 7 years ago

Last modified 7 years ago

#1836 closed defect (fixed)

USE permission on a bioplate is not enough to actually use it for biomaterial

Reported by: Nicklas Nordborg Owned by: everyone
Priority: minor Milestone: BASE 3.3.1
Component: core Version:
Keywords: Cc:

Description

Create a bioplate and share it to another user with USE permission. When logged in as that user, try to add biomaterial to the plate (for example via the plate template on the view-page).

The page will show "You are not allowed to add biomaterial to this well".

Trying to add biomaterial from the "Wells" tab opens a popup window but it only displays "Permission denied: Not allowed to write Biowell[id=xxx]"

The workaround is to give the user WRITE permission to the bioplate.

Change History (3)

comment:1 Changed 7 years ago by Nicklas Nordborg

Hmmm... seems to be a generic flaw for all items with a parent-child relationship.

  • READ permission on the parent translates to READ permission on the child.
  • WRITE (or higher) permission on the parent translates to WRITE, DELETE and CREATE permission on the child, but this can be overridden by the child item so that only USE permission is required.

What is missing in the above "implementation" is the case when the user has USE permission on the parent. This currently translates to READ permission on the child item but it should by default translate to USE permission also on the child.

That said, there also seems to be a flaw in the bioplate gui. The view page is correct in that it only checks if the user has USE permission, but the actual popup dialog checks for WRITE permission. The biowells list page is also not correct since it doesn't check the USE/WRITE permission at all.

comment:2 Changed 7 years ago by Nicklas Nordborg

Resolution: fixed
Status: newclosed

(In [6524]) Fixes #1836: USE permission on a bioplate is not enough to actually use it for biomaterial

Added ChildItem.getPermissionForUse() so that USE permission on parent can be transfered to the child item.

Fixed permission checking in biowells list and edit page so that it actually works if a user has USE permission.

comment:3 Changed 7 years ago by Nicklas Nordborg

(In [6528]) References #1836: USE permission on a bioplate is not enough to actually use it for biomaterial

Remove debyg output.

Note: See TracTickets for help on using tickets.