Repository: ckan/ckan

Issue:
Action status_show has no corresponding auth function
**CKAN version**

2.9.5

**Describe the bug**
The Action-API function `status_show` does not call a corresponding auth function (there is none). This means that, if a plugin _does_ register an auth function for `status_show`, there will be an error when the action is called.

**Steps to reproduce**
* Implement IAuthFunctions in a plugin and add `status_show` to `get_auth_functions()`.
* Call `status_show` as a non-sysadmin user.
* This leads to the exception above.

**Expected behavior**
If a plugin _does_ registers an auth function for `status_show`, I expect it to be called when the action is called.

**Additional details**
Stacktrace:

```
2022-04-28 08:06:19,368 ERROR [ckan.views.api] Action function status_show did not call its auth function
Traceback (most recent call last):
  File "/usr/lib/ckan/default/src/ckan/ckan/config/middleware/../../views/api.py", line 292, in action
    result = function(context, request_data)
  File "/usr/lib/ckan/default/src/ckan/ckan/logic/__init__.py", line 511, in wrapped
    raise Exception(
Exception: Action function status_show did not call its auth function
```

Action function:
https://github.com/ckan/ckan/blob/ca537ad25e13320b6fbf91f41031eadc30500f12/ckan/logic/action/get.py#L2406


Discussion:

Resolving patch:
diff --git a/ckan/logic/action/get.py b/ckan/logic/action/get.py
--- a/ckan/logic/action/get.py
+++ b/ckan/logic/action/get.py
@@ -2433,6 +2433,7 @@ def status_show(context: Context, data_dict: DataDict) -> ActionResult.StatusSho
     :rtype: dictionary
 
     '''
+    _check_access('status_show', context, data_dict)
     extensions = config.get_value('ckan.plugins')
 
     return {
diff --git a/ckan/logic/auth/get.py b/ckan/logic/auth/get.py
--- a/ckan/logic/auth/get.py
+++ b/ckan/logic/auth/get.py
@@ -487,3 +487,8 @@ def package_collaborator_list_for_user(context: Context,
     if user_obj and data_dict.get('id') in (user_obj.name, user_obj.id):
         return {'success': True}
     return {'success': False}
+
+
+def status_show(context: Context, data_dict: DataDict) -> AuthResult:
+    '''Show information about the site's configuration. Visible to all by default.'''
+    return {'success': True}


Test patch:
diff --git a/ckan/tests/logic/auth/test_get.py b/ckan/tests/logic/auth/test_get.py
--- a/ckan/tests/logic/auth/test_get.py
+++ b/ckan/tests/logic/auth/test_get.py
@@ -621,3 +621,11 @@ def test_sysadmin_can_list_followees(self, func):
         sysadmin = factories.Sysadmin()
         context = {"user": sysadmin["name"], "model": model}
         assert helpers.call_auth(func, context=context)
+
+
+@pytest.mark.usefixtures("non_clean_db")
+class TestStatusShow:
+
+    def test_status_show_is_visible_to_anonymous(self):
+        context = {"user": "", "model": model}
+        assert helpers.call_auth("status_show", context)
diff --git a/ckan/tests/test_coding_standards.py b/ckan/tests/test_coding_standards.py
--- a/ckan/tests/test_coding_standards.py
+++ b/ckan/tests/test_coding_standards.py
@@ -326,7 +326,6 @@ class TestActionAuth(object):
         "get: recently_changed_packages_activity_list",
         "get: resource_search",
         "get: roles_show",
-        "get: status_show",
         "get: tag_search",
         "get: term_translation_show",
         "get: user_followee_count",