GeoStory and Dashboard permissions for Anonymous users are reset on metadata updates

[saxas13]

Expected Behavior

Setting DEFAULT_ANONYMOUS_VIEW_PERMISSION=False and DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION=False applies to all Geonode ressoureces, which includes Datasets, Documents, Maps, Geostories and Dashboards.

Actual Behavior

Even though the environment is set up with DEFAULT_ANONYMOUS_VIEW_PERMISSION=False and DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION=False GeoStories and Dashboards get per Default "Viewing" Permission which seems critial, because this seems to overwrite the restrictions for maps.

I created a dashboard and a geostory with one Map which is set only to be visible to a specific group. I shared the ressoureces with the group, didn't looked at the other permissions, as for maps and layers are working as expected. When I logged out, the Dashboard and Story where visible and accessible, it also showed the Map which I set as Background to the title of the Story.

While I like the Idea, that I can use ressources in Geostories to show to "all" while keeping the ressources itself hidden, GeoStories and Dashboards should still take the default permissions into account.

Steps to Reproduce the Problem

1. Install Geonode with DEFAULT_ANONYMOUS_VIEW_PERMISSION=False and DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION=False
2. Upload Datasets, Create a Map of that Datasets
3. Create a Geostory/Dashboard with the Map as content and save it
4. Click on Share and see that "Anyone" ist set to "View"

Specifications

• GeoNode version: 4.1.3
• Installation type (vanilla, geonode-project): geonode-project
• Installation method (manual, docker): docker
• Platform: Ubuntu 20.04
• Additional details:

[giohappy]

@saxas13 I couldn't reproduce the problem. How are you setting the two configurations?

[saxas13]

When I set up the geonode-project I set these two variables (DEFAULT_ANONYMOUS_VIEW_PERMISSION and DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION) in .env file which are in a vanilla set to "true" (anyone can see everything) to "false" (nothing is per default visible).

[saxas13]

@giohappy I could reproduce the issue:
1.) create a new dashboard and save it -> permissions correct
2.) edit Metadata (I just switcht to the settings tab) and press update -> suddenly "Anyone" has viewing permissions
The Ressource is then visible to all, but the geoserver data was hidden. Need to check with Story tomorrow, because stories save their maps in ther own ressources (as embedded maps don't update with their origin map)

[giohappy]

Thanks @saxas13. I was able to reproduce it.
We will queue an investigation.

[saxas13]

@giohappy I just tested with Geostories, and as expected, as the Maps are stored withing the GeoStory as internal Ressource, they get visible including all Layers (eben the ones, which are not visible to Anyone)

[mattiagiupponi]

Hi @saxas13
I made a possible fix and is available in the branch named ISSUE_11578 is it possible to you to test it if it behaves as expected and the perms are assigned as expected?