Block user from starting queued downloads with set status #42

src/main/java/org/icatproject/topcat/web/rest/UserResource.java

@@ -260,6 +260,9 @@ public Response setDownloadStatus(
 		if (!download.getUserName().equals(cartUserName)) {
 			throw new ForbiddenException("you do not have permission to delete this download");
 		}
+        if (download.getPreparedId() == null && download.getStatus().equals(DownloadStatus.PAUSED)) {
+            throw new ForbiddenException("Cannot modify status of a queued download");
+        }
 
         download.setStatus(DownloadStatus.valueOf(value));
         if(value.equals("COMPLETE")){

src/test/java/org/icatproject/topcat/UserResourceTest.java

@@ -21,6 +21,8 @@
 
 import org.icatproject.topcat.httpclient.HttpClient;
 import org.icatproject.topcat.domain.*;
+import org.icatproject.topcat.exceptions.ForbiddenException;
+
 import java.net.URLEncoder;
 
 import org.icatproject.topcat.repository.CacheRepository;
@@ -255,6 +257,31 @@ public void testSubmitCart() throws Exception {
 		assertTrue(newDownload.getIsDeleted());
 	}
 
+	@Test
+	public void testSetDownloadStatus() throws Exception {
+		Download testDownload = new Download();
+		String facilityName = "LILS";
+		testDownload.setFacilityName(facilityName);
+		testDownload.setSessionId(sessionId);
+		testDownload.setStatus(DownloadStatus.PAUSED);
+		testDownload.setIsDeleted(false);
+		testDownload.setUserName("simple/root");
+		testDownload.setFileName("testFile.txt");
+		testDownload.setTransport("http");
+		downloadRepository.save(testDownload);
+
+		assertThrows("Cannot modify status of a queued download", ForbiddenException.class, () -> {
+			userResource.setDownloadStatus(testDownload.getId(), facilityName, sessionId, DownloadStatus.RESTORING.toString());
+		});
+
+		Response response = userResource.getDownloads(facilityName, sessionId, "1 = 1");
+		assertEquals(200, response.getStatus());
+		List<Download> downloads = (List<Download>) response.getEntity();
+
+		Download unmodifiedDownload = findDownload(downloads, testDownload.getId());
+		assertEquals(DownloadStatus.PAUSED, unmodifiedDownload.getStatus());
+	}
+
 	@Test
 	public void testGetDownloadTypeStatus() throws Exception {