From a958d89bf42ada4a143700246992bab1419c8fcc Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Tue, 20 Oct 2026 10:58:54 -0700 Subject: [PATCH] Add perms to document_page_image --- src/documents/tests/test_api_ocr_templates.py | 17 +++++++++++++++++ src/documents/views.py | 13 ++++++++++--- 2 files changed, 27 insertions(+), 3 deletions(-) diff --git a/src/documents/tests/test_api_ocr_templates.py b/src/documents/tests/test_api_ocr_templates.py index 4fa9ba445..452a2f320 100644 --- a/src/documents/tests/test_api_ocr_templates.py +++ b/src/documents/tests/test_api_ocr_templates.py @@ -14,6 +14,7 @@ from documents.models import OcrTemplate from documents.models import OcrTemplateZone from paperless_testing.dirs import DirectoriesMixin from paperless_testing.factories import DocumentFactory +from paperless_testing.permissions import grant_object class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase): @@ -438,6 +439,22 @@ class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase): ) extract.assert_not_called() + def test_document_page_image_requires_view_permission_on_the_document(self): + owner = User.objects.create_user(username="owner") + user = User.objects.create_user(username="template_editor") + user.user_permissions.add(Permission.objects.get(codename="view_ocrtemplate")) + document = DocumentFactory(owner=owner) + self.client.force_authenticate(user=user) + url = f"{self.ENDPOINT}document-page-image/{document.pk}/0/" + + response = self.client.get(url) + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + + grant_object(user, document, "view_document") + response = self.client.get(url) + # Past the permission check; the factory document has no file on disk. + self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND) + @patch("documents.zone_ocr.run_zone_extraction") def test_run_zone_ocr_requires_change_permission_on_the_document( self, diff --git a/src/documents/views.py b/src/documents/views.py index 427e99305..b619adac5 100644 --- a/src/documents/views.py +++ b/src/documents/views.py @@ -5857,10 +5857,15 @@ class OcrTemplateViewSet(ModelViewSet): as images that users can draw zones on. """ try: - document = Document.objects.get(pk=doc_id) + document = Document.objects.select_related( + "root_document__owner", + ).get(pk=doc_id) except Document.DoesNotExist: raise Http404("Document not found") + if not has_perms_owner_aware(request.user, "view_document", document): + return HttpResponseForbidden("Insufficient permissions") + page_num = int(page) # Validate page number @@ -5899,9 +5904,11 @@ class OcrTemplateViewSet(ModelViewSet): timeout=30, ) except subprocess.CalledProcessError as e: - raise Http404( - f"Failed to render page: {e.stderr.decode(errors='replace')[:200]}", + logger.warning( + f"Failed to render page {page_num} of document {document.pk}: " + f"{e.stderr.decode(errors='replace')[:200]}", ) + raise Http404("Failed to render page") except FileNotFoundError: raise Http404("pdftoppm not available - is poppler-utils installed?")