Merge branch 'master' into release

Author: suricactus

docker-app/qfieldcloud/core/models.py

@@ -2414,19 +2414,25 @@ def for_user_and_project(self, user: User, project: Project) -> SecretQueryset:
         secrets_qs = self.filter(
             Q(
                 # organization-assigned secrets
-                Q(organization=organization) & Q(assigned_to__isnull=True)
+                Q(organization=organization)
+                & Q(project__isnull=True)
+                & Q(assigned_to__isnull=True)
             )
             | Q(
                 # user-assigned organization secrets
-                Q(organization=organization) & Q(assigned_to=user)
+                Q(organization=organization)
+                & Q(project__isnull=True)
+                & Q(assigned_to=user)
             )
             | Q(
                 # project-assigned secrets
-                Q(project=project) & Q(assigned_to__isnull=True)
+                Q(organization__isnull=True)
+                & Q(project=project)
+                & Q(assigned_to__isnull=True)
             )
             | Q(
                 # user assigned project secrets
-                Q(project=project) & Q(assigned_to=user)
+                Q(organization__isnull=True) & Q(project=project) & Q(assigned_to=user)
             )
         )
 

docker-app/qfieldcloud/core/tests/test_secret.py

@@ -198,3 +198,29 @@ def test_check_secrets_type_priority(self):
 
         self.assertEqual(secrets.count(), 1)
         self.assertEqual(secrets[0], s1_project_assigned)
+
+    def test_check_secrets_do_not_leak(self):
+        p4 = Project.objects.create(name="p4", owner=self.u2)
+
+        p3_s1 = self._create_secret(name="p3_s1", project=self.p3)
+        p4_s2 = self._create_secret(name="p4_s2", project=p4)
+
+        secrets = Secret.objects.for_user_and_project(self.u1, self.p3)
+
+        self.assertEqual(secrets.count(), 1)
+        self.assertEqual(secrets[0], p3_s1)
+
+        with self.assertRaises(UserProjectRoleError):
+            secrets = Secret.objects.for_user_and_project(self.u1, p4)
+
+            self.assertEqual(secrets.count(), 0)
+
+        with self.assertRaises(UserProjectRoleError):
+            secrets = Secret.objects.for_user_and_project(self.u2, self.p3)
+
+            self.assertEqual(secrets.count(), 0)
+
+        secrets = Secret.objects.for_user_and_project(self.u2, p4)
+
+        self.assertEqual(secrets.count(), 1)
+        self.assertEqual(secrets[0], p4_s2)

docker-app/worker_wrapper/wrapper.py

@@ -432,12 +432,14 @@ def _prepare_deltas(self, deltas: Iterable[Delta]) -> dict[str, Any]:
         local_to_remote_pk_deltas = Delta.objects.filter(
             client_id__in=delta_client_ids,
             last_modified_pk__isnull=False,
-        ).values("client_id", "content__localPk", "last_modified_pk")
+        ).values(
+            "client_id", "content__localLayerId", "content__localPk", "last_modified_pk"
+        )
 
         client_pks_map = {}
 
         for delta_with_modified_pk in local_to_remote_pk_deltas:
-            key = f"{delta_with_modified_pk['client_id']}__{delta_with_modified_pk['content__localPk']}"
+            key = f"{delta_with_modified_pk['client_id']}__{delta_with_modified_pk['content__localLayerId']}__{delta_with_modified_pk['content__localPk']}"
             client_pks_map[key] = delta_with_modified_pk["last_modified_pk"]
 
         deltafile_contents = {

docker-qgis/qfc_worker/apply_deltas.py

@@ -816,7 +816,9 @@ def get_feature(
     source_pk = delta["sourcePk"]
 
     if client_pks:
-        client_pk_key = f"{delta['clientId']}__{delta['localPk']}"
+        client_pk_key = (
+            f"{delta['clientId']}__{delta['localLayerId']}__{delta['localPk']}"
+        )
         if client_pk_key in client_pks:
             source_pk = client_pks[client_pk_key]