diff --git a/server/app/app.py b/server/app/app.py index 80aefc7f..911ddf6e 100644 --- a/server/app/app.py +++ b/server/app/app.py @@ -58,7 +58,7 @@ def cache_control_always(**cache_kwargs): @webbp.route("/", methods=["GET"]) @cache_control(public=True, max_age=ONE_WEEK) -def dataset_index(dataset=None): +def dataset_index(url_dataroot=None, dataset=None): config = current_app.app_config if dataset is None: if config.single_dataset__datapath: @@ -66,7 +66,10 @@ def dataset_index(dataset=None): else: return dataroot_index() else: - location = path_join(config.multi_dataset__dataroot, dataset) + dataroot = config.multi_dataset__dataroot.get(url_dataroot) + if dataroot is None: + abort(HTTPStatus.NOT_FOUND) + location = path_join(dataroot, dataset) scripts = config.server__scripts inline_scripts = config.server__inline_scripts @@ -91,18 +94,21 @@ def health(): return health_check(config) -def get_data_adaptor(dataset=None): +def get_data_adaptor(url_dataroot=None, dataset=None): config = current_app.app_config if dataset is None: datapath = config.single_dataset__datapath else: - datapath = path_join(config.multi_dataset__dataroot, dataset) + dataroot = config.multi_dataset__dataroot.get(url_dataroot) + if dataroot is None: + raise DatasetAccessError(f"Invalid dataset {url_dataroot}/{dataset}") + datapath = path_join(dataroot, dataset) # path_join returns a normalized path. Therefore it is # sufficient to check that the datapath starts with the # dataroot to determine that the datapath is under the dataroot. - if not datapath.startswith(config.multi_dataset__dataroot): - raise DatasetAccessError("Invalid dataset {dataset}") + if not datapath.startswith(dataroot): + raise DatasetAccessError("Invalid dataset {url_dataroot}/{dataset}") if datapath is None: return common_rest.abort_and_log(HTTPStatus.BAD_REQUEST, "Invalid dataset NONE", loglevel=logging.INFO) @@ -115,7 +121,7 @@ def rest_get_data_adaptor(func): @wraps(func) def wrapped_function(self, dataset=None): try: - with get_data_adaptor(dataset) as data_adaptor: + with get_data_adaptor(self.url_dataroot, dataset) as data_adaptor: return func(self, data_adaptor) except DatasetAccessError: return common_rest.abort_and_log( @@ -132,22 +138,23 @@ def dataroot_test_index(): data += "