Scope laboratory assay template lookups to the request container

The assay_run_templates lookups in DefaultAssayParser.saveTemplate, DefaultAssayParser.getTemplateRowMap, and AssayHelper.saveTemplate filtered only by rowid, which is the table's global primary key. Because Table.update also operates by global PK, a user could pass a templateId belonging to another container and have that foreign template loaded and updated (runid/status), bypassing container authorization. Each lookup now adds a container condition scoped to the request container before reading or updating the row. Follow-up to #286.

Author: labkey-martyp

laboratory/api-src/org/labkey/api/laboratory/assay/DefaultAssayParser.java

@@ -466,9 +466,11 @@ protected void saveTemplate(ViewContext ctx, int templateId, int runId) throws B
     {
         try
         {
-            //validate the template exists
+            //validate the template exists in this container
             TableInfo ti = DbSchema.get("laboratory").getTable("assay_run_templates");
-            TableSelector ts = new TableSelector(ti, new SimpleFilter(FieldKey.fromString("rowid"), templateId), null);
+            SimpleFilter filter = new SimpleFilter(FieldKey.fromString("rowid"), templateId);
+            filter.addCondition(FieldKey.fromString("container"), _container);
+            TableSelector ts = new TableSelector(ti, filter, null);
             if (ts.getRowCount() == 0)
             {
                 throw new BatchValidationException(Collections.singletonList(new ValidationException("Unknown template: " + templateId)), null);
@@ -586,7 +588,9 @@ protected Map<String, Map<String, Object>> getTemplateRowMap(ImportContext conte
 
         TableInfo ti = DbSchema.get("laboratory").getTable("assay_run_templates");
 
-        TableSelector ts = new TableSelector(ti, new SimpleFilter(FieldKey.fromString("rowid"), templateId), null);
+        SimpleFilter filter = new SimpleFilter(FieldKey.fromString("rowid"), templateId);
+        filter.addCondition(FieldKey.fromString("container"), _container);
+        TableSelector ts = new TableSelector(ti, filter, null);
         Map<String, Object>[] maps = ts.getMapArray();
         if (maps.length == 0)
         {

laboratory/src/org/labkey/laboratory/assay/AssayHelper.java

@@ -33,6 +33,7 @@
 import org.labkey.api.data.Container;
 import org.labkey.api.data.ContainerManager;
 import org.labkey.api.data.RuntimeSQLException;
+import org.labkey.api.data.SimpleFilter;
 import org.labkey.api.data.TSVMapWriter;
 import org.labkey.api.data.Table;
 import org.labkey.api.data.TableInfo;
@@ -51,6 +52,7 @@
 import org.labkey.api.laboratory.assay.AssayDataProvider;
 import org.labkey.api.laboratory.assay.AssayImportMethod;
 import org.labkey.api.query.BatchValidationException;
+import org.labkey.api.query.FieldKey;
 import org.labkey.api.query.ValidationException;
 import org.labkey.api.security.User;
 import org.labkey.api.util.FileUtil;
@@ -139,6 +141,15 @@ public Map<String, Object> saveTemplate(User u, Container c, ExpProtocol protoco
             }
             else
             {
+                // Table.update operates by global PK, so verify the existing template lives in this container before updating it
+                SimpleFilter filter = new SimpleFilter(FieldKey.fromString("rowid"), templateId);
+                filter.addCondition(FieldKey.fromString("container"), c);
+                if (!new TableSelector(ti, filter, null).exists())
+                {
+                    errors.addRowError(new ValidationException("Unknown template: " + templateId));
+                    throw errors;
+                }
+
                 row.put("rowid", templateId);
                 row = Table.update(u, ti, row, templateId);
             }