{"action":"created","issue":{"url":"https://api.github.com/repos/IQSS/dataverse/issues/2648","labels_url":"https://api.github.com/repos/IQSS/dataverse/issues/2648/labels{/name}","comments_url":"https://api.github.com/repos/IQSS/dataverse/issues/2648/comments","events_url":"https://api.github.com/repos/IQSS/dataverse/issues/2648/events","html_url":"https://github.com/IQSS/dataverse/issues/2648","id":111884137,"number":2648,"title":"Bug: unpublished files can be downloaded by users with the File Downloader role (DownloadFile permission) on that file or inherited from dataset or dataverse","user":{"login":"pdurbin","id":21006,"avatar_url":"https://avatars.githubusercontent.com/u/21006?v=3","gravatar_id":"","url":"https://api.github.com/users/pdurbin","html_url":"https://github.com/pdurbin","followers_url":"https://api.github.com/users/pdurbin/followers","following_url":"https://api.github.com/users/pdurbin/following{/other_user}","gists_url":"https://api.github.com/users/pdurbin/gists{/gist_id}","starred_url":"https://api.github.com/users/pdurbin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pdurbin/subscriptions","organizations_url":"https://api.github.com/users/pdurbin/orgs","repos_url":"https://api.github.com/users/pdurbin/repos","events_url":"https://api.github.com/users/pdurbin/events{/privacy}","received_events_url":"https://api.github.com/users/pdurbin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Component:%20API","name":"Component: API","color":"c7def8"},{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Component:%20File%20Upload%20&%20Handling","name":"Component: File Upload & Handling","color":"c7def8"},{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Priority:%20Medium","name":"Priority: Medium","color":"cc6666"},{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Status:%20QA","name":"Status: QA","color":"336633"},{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Type:%20Bug","name":"Type: Bug","color":"fef2c0"}],"state":"open","locked":false,"assignee":{"login":"kcondon","id":4983816,"avatar_url":"https://avatars.githubusercontent.com/u/4983816?v=3","gravatar_id":"","url":"https://api.github.com/users/kcondon","html_url":"https://github.com/kcondon","followers_url":"https://api.github.com/users/kcondon/followers","following_url":"https://api.github.com/users/kcondon/following{/other_user}","gists_url":"https://api.github.com/users/kcondon/gists{/gist_id}","starred_url":"https://api.github.com/users/kcondon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcondon/subscriptions","organizations_url":"https://api.github.com/users/kcondon/orgs","repos_url":"https://api.github.com/users/kcondon/repos","events_url":"https://api.github.com/users/kcondon/events{/privacy}","received_events_url":"https://api.github.com/users/kcondon/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/IQSS/dataverse/milestones/45","html_url":"https://github.com/IQSS/dataverse/milestones/4.2.1%20Performance%20patch","labels_url":"https://api.github.com/repos/IQSS/dataverse/milestones/45/labels","id":1349541,"number":45,"title":"4.2.1 Performance patch","description":"","creator":{"login":"scolapasta","id":4268292,"avatar_url":"https://avatars.githubusercontent.com/u/4268292?v=3","gravatar_id":"","url":"https://api.github.com/users/scolapasta","html_url":"https://github.com/scolapasta","followers_url":"https://api.github.com/users/scolapasta/followers","following_url":"https://api.github.com/users/scolapasta/following{/other_user}","gists_url":"https://api.github.com/users/scolapasta/gists{/gist_id}","starred_url":"https://api.github.com/users/scolapasta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scolapasta/subscriptions","organizations_url":"https://api.github.com/users/scolapasta/orgs","repos_url":"https://api.github.com/users/scolapasta/repos","events_url":"https://api.github.com/users/scolapasta/events{/privacy}","received_events_url":"https://api.github.com/users/scolapasta/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":10,"state":"open","created_at":"2015-10-11T19:06:57Z","updated_at":"2015-10-22T18:00:13Z","due_on":"2015-10-27T04:00:00Z","closed_at":null},"comments":20,"created_at":"2015-10-16T18:22:10Z","updated_at":"2015-10-22T19:30:59Z","closed_at":null,"body":"As clarified in c8e49f2 the File Downloader role should only apply to **published** files. Currently, if a user (or group, presumably) is assigned the DownloadFile permission to an unpublished file (either directly or through inheritance, it is believed), that user can download the file if he or she knows the file id. That is to say, if a user clicks a link to http://localhost:8080/api/access/datafile/12 (for example) and is logged in to Dataverse, the file can be downloaded even if hasn't been published. This is not the intended behavior.\r\n\r\nThe intention is that a dataset is being prepared and files are being set to restricted, the File Downloader role can be assigned ahead of time, before the dataset is published. The role should have no affect, however, until the dataset is published, as discussed at #2645. (This should probably be documented.)\r\n\r\nTesting of this issue should include assigning the DownloadFile permission at various levels such as at the file itself, at the file's parent dataset, and at the dataset's parent dataverse. Testing should include assignment of the role to both users and groups."},"comment":{"url":"https://api.github.com/repos/IQSS/dataverse/issues/comments/150330290","html_url":"https://github.com/IQSS/dataverse/issues/2648#issuecomment-150330290","issue_url":"https://api.github.com/repos/IQSS/dataverse/issues/2648","id":150330290,"user":{"login":"pdurbin","id":21006,"avatar_url":"https://avatars.githubusercontent.com/u/21006?v=3","gravatar_id":"","url":"https://api.github.com/users/pdurbin","html_url":"https://github.com/pdurbin","followers_url":"https://api.github.com/users/pdurbin/followers","following_url":"https://api.github.com/users/pdurbin/following{/other_user}","gists_url":"https://api.github.com/users/pdurbin/gists{/gist_id}","starred_url":"https://api.github.com/users/pdurbin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pdurbin/subscriptions","organizations_url":"https://api.github.com/users/pdurbin/orgs","repos_url":"https://api.github.com/users/pdurbin/repos","events_url":"https://api.github.com/users/pdurbin/events{/privacy}","received_events_url":"https://api.github.com/users/pdurbin/received_events","type":"User","site_admin":false},"created_at":"2015-10-22T19:30:59Z","updated_at":"2015-10-22T19:30:59Z","body":"> // if the file is NOT published, we will let them download the\r\n> // file ONLY if they also have the permission to view\r\n> // the unpublished verion (this will catch the owner/contributors):\r\n> if (permissionService.on(df.getOwner()).has(Permission.ViewUnpublishedDataset)) {\r\n> return true; // access granted\r\n\r\n@landreev this is what I meant when I was saying that I was thinking the solution is to use some other permission other than \"DownloadFile\" as a proxy for the owner/contributors/whatever to be able to download the file. My original comments on this are here if anyone cares to see: 5a23511 . I find this a little strange to have a proxy permission like this. Not that I blame you. I came to the same conclusion!\r\n\r\nOh and the meaning of \"DownloadFile\" has changed, really, in 4.2.1. It now means \"DownloadPublishedFile\". That's why @eaquigley made this change in 4.2.1: c8e49f2 . I'm not sure what's changes other than that have happened UI-wise for all this (many sub-issues of #2645 were created) but it would be nice to communicate both in the GUI and the User Guide how this all works now. Oh, and [Permission.java](https://github.com/IQSS/dataverse/blob/v4.2/src/main/java/edu/harvard/iq/dataverse/authorization/Permission.java) still says \"Download a file\" (nothing about published) but I'm not even sure where this string appears.\r\n\r\nAnyway, from reading through the code it does seem cleaner. Good job."}}