Add perms to document_page_image

src/documents/tests/test_api_ocr_templates.py

@@ -14,6 +14,7 @@ from documents.models import OcrTemplate
 from documents.models import OcrTemplateZone
 from paperless_testing.dirs import DirectoriesMixin
 from paperless_testing.factories import DocumentFactory
+from paperless_testing.permissions import grant_object
 
 
 class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase):
@@ -438,6 +439,22 @@ class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase):
                 )
         extract.assert_not_called()
 
+    def test_document_page_image_requires_view_permission_on_the_document(self):
+        owner = User.objects.create_user(username="owner")
+        user = User.objects.create_user(username="template_editor")
+        user.user_permissions.add(Permission.objects.get(codename="view_ocrtemplate"))
+        document = DocumentFactory(owner=owner)
+        self.client.force_authenticate(user=user)
+        url = f"{self.ENDPOINT}document-page-image/{document.pk}/0/"
+
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+        grant_object(user, document, "view_document")
+        response = self.client.get(url)
+        # Past the permission check; the factory document has no file on disk.
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+
     @patch("documents.zone_ocr.run_zone_extraction")
     def test_run_zone_ocr_requires_change_permission_on_the_document(
         self,

src/documents/views.py

@@ -5857,10 +5857,15 @@ class OcrTemplateViewSet(ModelViewSet):
         as images that users can draw zones on.
         """
         try:
-            document = Document.objects.get(pk=doc_id)
+            document = Document.objects.select_related(
+                "root_document__owner",
+            ).get(pk=doc_id)
         except Document.DoesNotExist:
             raise Http404("Document not found")
 
+        if not has_perms_owner_aware(request.user, "view_document", document):
+            return HttpResponseForbidden("Insufficient permissions")
+
         page_num = int(page)
 
         # Validate page number
@@ -5899,9 +5904,11 @@ class OcrTemplateViewSet(ModelViewSet):
                     timeout=30,
                 )
             except subprocess.CalledProcessError as e:
-                raise Http404(
-                    f"Failed to render page: {e.stderr.decode(errors='replace')[:200]}",
+                logger.warning(
+                    f"Failed to render page {page_num} of document {document.pk}: "
+                    f"{e.stderr.decode(errors='replace')[:200]}",
                 )
+                raise Http404("Failed to render page")
             except FileNotFoundError:
                 raise Http404("pdftoppm not available - is poppler-utils installed?")