{"action":"created","issue":{"url":"https://api.github.com/repos/inveniosoftware/invenio/issues/3638","repository_url":"https://api.github.com/repos/inveniosoftware/invenio","labels_url":"https://api.github.com/repos/inveniosoftware/invenio/issues/3638/labels{/name}","comments_url":"https://api.github.com/repos/inveniosoftware/invenio/issues/3638/comments","events_url":"https://api.github.com/repos/inveniosoftware/invenio/issues/3638/events","html_url":"https://github.com/inveniosoftware/invenio/issues/3638","id":160343523,"number":3638,"title":"guest user and records in restricted collection (invenio 1.2)","user":{"login":"martinkoehler","id":9458435,"avatar_url":"https://avatars.githubusercontent.com/u/9458435?v=3","gravatar_id":"","url":"https://api.github.com/users/martinkoehler","html_url":"https://github.com/martinkoehler","followers_url":"https://api.github.com/users/martinkoehler/followers","following_url":"https://api.github.com/users/martinkoehler/following{/other_user}","gists_url":"https://api.github.com/users/martinkoehler/gists{/gist_id}","starred_url":"https://api.github.com/users/martinkoehler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinkoehler/subscriptions","organizations_url":"https://api.github.com/users/martinkoehler/orgs","repos_url":"https://api.github.com/users/martinkoehler/repos","events_url":"https://api.github.com/users/martinkoehler/events{/privacy}","received_events_url":"https://api.github.com/users/martinkoehler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-06-15T05:51:59Z","updated_at":"2016-06-15T07:39:26Z","closed_at":null,"body":"There seems to be a bug in invenio 1.2\r\nWhen a record is in a public collection in the global collection tree and restricted collection, while the latter is not in the collection tree, but guest is allowed to see records in this collection, this record will not be displayed in search.\r\nHow to reproduce:\r\n* Enable  ´CFG_WEBSEARCH_VIEWRESTRCOLL_POLICY = ANY`\r\n* Define a public collection in the collection tree (e.g. Public)\r\n* Define a restricted collection outside the collection tree (e.g. Unrestricted) with fireroll viewrestrcol allow any\r\n* Put a record in both collection\r\nNow guest user should be able to view the record\r\n* Search for the record as guest user\r\nThe record is not displayed\r\n\r\nThis seemed due to a \"short cut\" in webuser.py and search_engine.py\r\nA quick fix is:\r\nin webuser.py\r\n```\r\n1393,1395d1392\r\n< else: # guest user\r\n< user_info['precached_permitted_restricted_collections'] = get_permitted_restricted_collections(user_info)\r\n< \r\n\r\n```\r\nWhich ensures that the user Object of the guest user gets a possible non empty precached_permitted_restricted_collections\r\n\r\nIn search_engine.py the code wrongly assumes that for a guest user precached_permitted_restricted_collections is always empty.\r\nA fix here:\r\n\r\n```3093,3096c3093,3096\r\n\r\n<             permitted_restricted_collections = []\r\n<             ## For guest users that are actually authorized to some restricted\r\n<             ## collection (by virtue of the IP address in a FireRole rule)\r\n<             ## we explicitly build the list of permitted_restricted_collections\r\n---\r\n>             permitted_restricted_collections =  user_info.get('precached_permitted_restricted_collections', [])\r\n>             # For guest users that are actually authorized to some restricted\r\n>             # collection (by virtue of the IP address in a FireRole rule)\r\n>             # we explicitly build the list of permitted_restricted_collections and we make sure that these are used in the search engine`\r\n\r\n```\r\nNote:\r\nThe code\r\n```\r\nfor coll in colls:\r\n                if collection_restricted_p(coll) and (acc_authorize_action(user_info, 'viewrestrcoll', collection=coll)[0] == 0):\r\n                    permitted_restricted_collections.append(coll)\r\n```\r\nis not enough, since e.g. the restricted collection \"Unrestricted\" is not in `colls`\r\n\r\n@tiborsimko and @kaplun: Does it help if I prepare a pull-reqest for this fix?"},"comment":{"url":"https://api.github.com/repos/inveniosoftware/invenio/issues/comments/226111660","html_url":"https://github.com/inveniosoftware/invenio/issues/3638#issuecomment-226111660","issue_url":"https://api.github.com/repos/inveniosoftware/invenio/issues/3638","id":226111660,"user":{"login":"martinkoehler","id":9458435,"avatar_url":"https://avatars.githubusercontent.com/u/9458435?v=3","gravatar_id":"","url":"https://api.github.com/users/martinkoehler","html_url":"https://github.com/martinkoehler","followers_url":"https://api.github.com/users/martinkoehler/followers","following_url":"https://api.github.com/users/martinkoehler/following{/other_user}","gists_url":"https://api.github.com/users/martinkoehler/gists{/gist_id}","starred_url":"https://api.github.com/users/martinkoehler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinkoehler/subscriptions","organizations_url":"https://api.github.com/users/martinkoehler/orgs","repos_url":"https://api.github.com/users/martinkoehler/repos","events_url":"https://api.github.com/users/martinkoehler/events{/privacy}","received_events_url":"https://api.github.com/users/martinkoehler/received_events","type":"User","site_admin":false},"created_at":"2016-06-15T07:39:26Z","updated_at":"2016-06-15T07:39:26Z","body":"Habe ich nicht geprüfte\r\nAuf der bib-pubdb-sl6 ist der Fix im Moment aktiv"}}
{"actor":{"display_login":"martinkoehler"}}