Merge branch 'hotfix/24.04.3' into develop

addons/base/views.py

@@ -206,7 +206,7 @@ def check_resource_permissions(resource, auth, action):
 
 def _check_registration_permissions(registration, auth, permission, action):
     if permission == permissions.READ:
-        return registration.registered_from.can_view(auth)
+        return registration.can_view(auth) or registration.registered_from.can_view(auth)
     if action in ('copyfrom', 'upload'):
         return _check_hierarchical_write_permissions(resource=registration, auth=auth)
     return registration.can_edit(auth)
@@ -241,6 +241,19 @@ def _check_hierarchical_write_permissions(resource, auth):
         permissions_resource = permissions_resource.parent_node
     return False
 
+def _download_is_from_mfr(waterbutler_data):
+    metrics_data = waterbutler_data['metrics']
+    uri = metrics_data['uri']
+    is_render_uri = furl.furl(uri or '').query.params.get('mode') == 'render'
+    return (
+        # This header is sent for download requests that
+        # originate from MFR, e.g. for the code pygments renderer
+        request.headers.get('X-Cos-Mfr-Render-Request', None) or
+        # Need to check the URI in order to account
+        # for renderers that send XHRs from the
+        # rendered content, e.g. PDFs
+        is_render_uri
+    )
 
 def make_auth(user):
     if user is not None:
@@ -415,7 +428,7 @@ def get_auth(auth, **kwargs):
         # Trigger any file-specific signals based on the action taken (e.g., file viewed, downloaded)
         if action == 'render':
             file_signals.file_viewed.send(auth=auth, fileversion=fileversion, file_node=file_node)
-        elif action == 'download':
+        elif action == 'download' and not _download_is_from_mfr(waterbutler_data):
             file_signals.file_downloaded.send(auth=auth, fileversion=fileversion, file_node=file_node)
 
     # Construct the response payload including the JWT