Dataset Template Parent Dataverse can be changed via ownerId query parameter
Open
Nobody has claimed this yet.
Component: JSF
Feature: Publishing & Versions
Type: Bug
User Role: Depositor
UX & UI: New React UI
Vote to Close: pdurbin
- Dominant language
- Java
- Stars
- 1.1k
- Forks
- 564
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 29
Description
Steps to reproduce:
- Create dataset template under a dataverse and save.
- Edit the saved dataset template, but change ownerId (dataverse id) in the url string to be a different ID (for example, use 1 for root)
- Save the template. Now it will be under the new dataverse.
I discovered this issue in 5.12.1, writing selenium tests for FDA compliance. What probably should happen is that if the wrong ownerId is provided on edit the page should error? Maybe edit shouldn't need an ownerId at all?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the saved dataset-template edit using a changed ownerId in the URL, then trace the edit handling for dataset templates and how the parent Dataverse is selected. Clarify whether ownerId should be rejected or omitted, and add coverage showing that an edit cannot move the template to another Dataverse and returns the intended error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100