fix #2258

qiita_pet/handlers/analysis_handlers/sharing_handlers.py

@@ -49,8 +49,7 @@ def _unshare(self, analysis, user, callback):
     def get(self):
         analysis_id = int(self.get_argument('id'))
         analysis = Analysis(analysis_id)
-        if self.current_user != analysis.owner and \
-           self.current_user not in analysis.shared_with:
+        if not analysis.has_access(self.current_user):
             raise HTTPError(403, 'User %s does not have permissions to share '
                             'analysis %s' % (
                                 self.current_user.id, analysis.id))

qiita_pet/handlers/analysis_handlers/tests/test_sharing_handlers.py

@@ -8,9 +8,11 @@
 
 from unittest import main
 from json import loads
+from mock import Mock
 
 from qiita_db.analysis import Analysis
 from qiita_db.user import User
+from qiita_pet.handlers.base_handlers import BaseHandler
 from qiita_pet.test.tornado_test_base import TestHandlerBase
 
 
@@ -49,6 +51,15 @@ def test_get(self):
             'Analysis <a href="/analysis/description/1">\'SomeAnalysis\'</a> '
             'has been shared with you.', u.messages()[0][1])
 
+        # admins can share
+        BaseHandler.get_current_user = Mock(return_value=User("admin@foo.bar"))
+        args = {'deselected': u.id, 'id': a.id}
+        response = self.get('/analysis/sharing/', args)
+        self.assertEqual(response.code, 200)
+        exp = {'users': [], 'links': ''}
+        self.assertEqual(loads(response.body), exp)
+        self.assertEqual(a.shared_with, [])
+
     def test_get_no_access(self):
         args = {'selected': 'demo@microbio.me', 'id': 2}
         response = self.get('/analysis/sharing/', args)