ARTMXCICH-149/Fix ResourceDocsEditView to restrict access to only resources belonging to the dataset

ckanext/resource_docs/views.py

@@ -23,11 +23,16 @@ def get(self, package_id: str, resource_id: str) -> str:
             )
 
             pkg_dict = tk.get_action("package_show")({}, {"id": package_id})
-            resource = tk.get_action("resource_show")({}, {"id": resource_id})
 
         except (tk.ObjectNotFound, tk.NotAuthorized):
             return tk.abort(404, tk._("Resource not found"))
 
+        resources = {res["id"]: res for res in pkg_dict.get("resources", [])}
+        resource = resources.get(resource_id)
+
+        if not resource:
+            return tk.abort(404, tk._("Resource not found"))
+
         try:
             docs = tk.get_action("resource_docs_show")({}, {"resource_id": resource_id})
         except tk.ObjectNotFound:

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ckanext-resource-docs"
-version = "0.4.2"
+version = "0.4.3"
 description = "A CKAN extension that lets you attach a flexible, schema-free data dictionary (“resource documentation”) to any resource, not just Datastore-backed ones."
 readme = "README.md"
 authors = [{ name = "Oleksandr Cherniavskiy", email = "[email protected]" }]