{"action":"created","issue":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/4996","repository_url":"https://api.github.com/repos/CenterForOpenScience/osf.io","labels_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/4996/labels{/name}","comments_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/4996/comments","events_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/4996/events","html_url":"https://github.com/CenterForOpenScience/osf.io/pull/4996","id":131667616,"number":4996,"title":"[Ready to Review] API Incorrect Log Permissions and using LogMixin","user":{"login":"pattisdr","id":9755598,"avatar_url":"https://avatars.githubusercontent.com/u/9755598?v=3","gravatar_id":"","url":"https://api.github.com/users/pattisdr","html_url":"https://github.com/pattisdr","followers_url":"https://api.github.com/users/pattisdr/followers","following_url":"https://api.github.com/users/pattisdr/following{/other_user}","gists_url":"https://api.github.com/users/pattisdr/gists{/gist_id}","starred_url":"https://api.github.com/users/pattisdr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pattisdr/subscriptions","organizations_url":"https://api.github.com/users/pattisdr/orgs","repos_url":"https://api.github.com/users/pattisdr/repos","events_url":"https://api.github.com/users/pattisdr/events{/privacy}","received_events_url":"https://api.github.com/users/pattisdr/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/milestones/63","html_url":"https://github.com/CenterForOpenScience/osf.io/milestones/0.64.0","labels_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/milestones/63/labels","id":1544458,"number":63,"title":"0.64.0","description":"","creator":{"login":"sloria","id":2379650,"avatar_url":"https://avatars.githubusercontent.com/u/2379650?v=3","gravatar_id":"","url":"https://api.github.com/users/sloria","html_url":"https://github.com/sloria","followers_url":"https://api.github.com/users/sloria/followers","following_url":"https://api.github.com/users/sloria/following{/other_user}","gists_url":"https://api.github.com/users/sloria/gists{/gist_id}","starred_url":"https://api.github.com/users/sloria/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sloria/subscriptions","organizations_url":"https://api.github.com/users/sloria/orgs","repos_url":"https://api.github.com/users/sloria/repos","events_url":"https://api.github.com/users/sloria/events{/privacy}","received_events_url":"https://api.github.com/users/sloria/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":11,"state":"open","created_at":"2016-01-26T17:00:14Z","updated_at":"2016-02-09T18:21:35Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2016-02-05T15:10:39Z","updated_at":"2016-02-09T18:21:35Z","closed_at":"2016-02-09T18:21:35Z","pull_request":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/4996","html_url":"https://github.com/CenterForOpenScience/osf.io/pull/4996","diff_url":"https://github.com/CenterForOpenScience/osf.io/pull/4996.diff","patch_url":"https://github.com/CenterForOpenScience/osf.io/pull/4996.patch"},"body":"# Purpose\r\n\r\nIssue: https://openscience.atlassian.net/browse/OSF-5665\r\n\r\nAPI log permissions are incorrect. Users can currently view logs for nodes that don't have permission to view.  Log endpoints are returning 200, regardless of user permissions.\r\n\r\nAlso, the api endpoint `/v2/logs/{log_id}/nodes/` is giving a 500 error on develop.\r\n\r\n# Changes\r\n\r\n1) Updated permissions on LogNodeList, NodeLogDetail, and NodeLogAddedContributors.  The user can only view the log if they have permission to view one of the nodes on the log's backrefs.  This permission check will be even shorter when backrefs are removed between nodes and nodelogs because every log will be associated with exactly one node.\r\n\r\n2) Had LogNodeList, and NodeLogDetail inherit from LogMixin so get_log() method is available. This was causing the 500 error.\r\n\r\n3) Add tests for the three views.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/comments/181990860","html_url":"https://github.com/CenterForOpenScience/osf.io/pull/4996#issuecomment-181990860","issue_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/4996","id":181990860,"user":{"login":"pattisdr","id":9755598,"avatar_url":"https://avatars.githubusercontent.com/u/9755598?v=3","gravatar_id":"","url":"https://api.github.com/users/pattisdr","html_url":"https://github.com/pattisdr","followers_url":"https://api.github.com/users/pattisdr/followers","following_url":"https://api.github.com/users/pattisdr/following{/other_user}","gists_url":"https://api.github.com/users/pattisdr/gists{/gist_id}","starred_url":"https://api.github.com/users/pattisdr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pattisdr/subscriptions","organizations_url":"https://api.github.com/users/pattisdr/orgs","repos_url":"https://api.github.com/users/pattisdr/repos","events_url":"https://api.github.com/users/pattisdr/events{/privacy}","received_events_url":"https://api.github.com/users/pattisdr/received_events","type":"User","site_admin":false},"created_at":"2016-02-09T18:21:35Z","updated_at":"2016-02-09T18:21:35Z","body":"Became hotfix #5004 "}}