Check permissions on canned query page, refs #800

simonw · Jun 6, 2020 · 966eec7 · 966eec7
1 parent 070838b
commit 966eec7
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/datasette/views/database.py b/datasette/views/database.py
@@ -9,7 +9,7 @@
     path_with_added_args,
     path_with_removed_args,
 )
-from datasette.utils.asgi import AsgiFileDownload
+from datasette.utils.asgi import AsgiFileDownload, Response
 from datasette.plugins import pm
 
 from .base import DatasetteError, DataView
@@ -125,6 +125,14 @@ async def data(
             params.pop("sql")
         if "_shape" in params:
             params.pop("_shape")
+
+        # Respect canned query permissions
+        if canned_query:
+            if not actor_matches_allow(
+                request.scope.get("actor", None), metadata.get("allow")
+            ):
+                return Response("Permission denied", status=403)
+
         # Extract any :named parameters
         named_parameters = named_parameters or self.re_named_parameter.findall(sql)
         named_parameter_values = {

diff --git a/tests/test_canned_write.py b/tests/test_canned_write.py
@@ -128,3 +128,11 @@ def test_canned_query_permissions_on_database_page(canned_write_client):
         {"name": q["name"], "requires_auth": q["requires_auth"]}
         for q in response.json["queries"]
     ]
+
+
+def test_canned_query_permissions(canned_write_client):
+    assert 403 == canned_write_client.get("/data/delete_name").status
+    assert 200 == canned_write_client.get("/data/update_name").status
+    cookies = {"ds_actor": canned_write_client.ds.sign({"id": "root"}, "actor")}
+    assert 200 == canned_write_client.get("/data/delete_name", cookies=cookies).status
+    assert 200 == canned_write_client.get("/data/update_name", cookies=cookies).status