Permissions: Anonymous user can directly access draft version of dataset an download files.

[eaquigley]

---

Author Name: Kevin Condon (@kcondon)
Original Redmine Issue: 3898, https://redmine.hmdc.harvard.edu/issues/3898
Original Date: 2014-04-28
Original Assignee: Kevin Condon

---

Phil pointed this out. Currently, an anonymous user can see the draft version of a published study and download files. Phil will address the indexing part but the permissions still allow an anonymous user to do this.

[eaquigley]

---

Original Redmine Comment
Author Name: Gustavo Durand (@scolapasta)
Original Date: 2014-04-28T21:01:51Z

---

For beta, we will live with this, but we do want to try and limit the user from seeing links that will get them thee.

In other words, if someone sends them the link, then they can go to it, but they sholdn't be able to just by clicking around.

One place to check is the versions tab for a dataset.

[eaquigley]

---

Original Redmine Comment
Author Name: Steve Kraffmiller (@sekmiller)
Original Date: 2014-04-30T19:02:17Z

---

Unprivileged users will not be able to see unpublished versions. they also won't see the links on the version tab.

[eaquigley]

---

Original Redmine Comment
Author Name: Kevin Condon (@kcondon)
Original Date: 2014-05-01T19:38:21Z

---

Tested on 5/1

Yes, works as described. If given direct link other user can create datasets in dv they don't own but guess that is ok for now.