diff --git a/aleksis/core/util/core_helpers.py b/aleksis/core/util/core_helpers.py index a1423bd5b4c15dd50d0665e1257b822bf55115c0..48647519dcbaade04a26a31fc23328a47e4bdb89 100644 --- a/aleksis/core/util/core_helpers.py +++ b/aleksis/core/util/core_helpers.py @@ -300,3 +300,23 @@ def monkey_patch() -> None: # noqa return super().default(o) json.DjangoJSONEncoder = DjangoJSONEncoder + + +def get_allowed_object_ids(request: HttpRequest, models: list) -> list: + """Get all objects of all given models the user of a given request is allowed to view.""" + allowed_object_ids = [] + + for model in models: + app_label = model._meta.app_label + model_name = model.__name__.lower() + + # Loop through the pks of all objects of the current model the user is allowed to view + # and put the corresponding ids into a django-haystack-style-formatted list + allowed_object_ids += [ + f"{app_label}.{model_name}.{pk}" + for pk in queryset_rules_filter( + request, model.objects.all(), f"{app_label}.view_{model_name}_rule" + ).values_list("pk", flat=True) + ] + + return allowed_object_ids diff --git a/aleksis/core/views.py b/aleksis/core/views.py index 0174dd6c99043979650c0a508fe79eaa7ac26715..d1f5e76d16d7b192f10aaa376d7845c1f0c59a09 100644 --- a/aleksis/core/views.py +++ b/aleksis/core/views.py @@ -86,6 +86,7 @@ from .util import messages from .util.apps import AppConfig from .util.celery_progress import render_progress_page from .util.core_helpers import ( + get_allowed_object_ids, get_site_preferences, has_person, objectgetter_optional, @@ -566,17 +567,7 @@ def searchbar_snippets(request: HttpRequest) -> HttpResponse: indexed_models = UnifiedIndex().get_indexed_models() - allowed_object_ids = [] - - for model in indexed_models: - app_label = ContentType.objects.get_for_model(model).app_label - model_name = ContentType.objects.get_for_model(model).model - allowed_object_ids += [ - f"{app_label}.{model_name}.{pk}" - for pk in queryset_rules_filter( - request, model.objects.all(), f"{app_label}.view_{model_name}_rule" - ).values_list("pk", flat=True) - ] + allowed_object_ids = get_allowed_object_ids(request, indexed_models) results = ( SearchQuerySet().filter(id__in=allowed_object_ids).filter(text=AutoQuery(query))[:limit] @@ -597,17 +588,7 @@ class PermissionSearchView(PermissionRequiredMixin, SearchView): indexed_models = UnifiedIndex().get_indexed_models() - allowed_object_ids = [] - - for model in indexed_models: - app_label = ContentType.objects.get_for_model(model).app_label - model_name = ContentType.objects.get_for_model(model).model - allowed_object_ids += [ - f"{app_label}.{model_name}.{pk}" - for pk in queryset_rules_filter( - self.request, model.objects.all(), f"{app_label}.view_{model_name}_rule" - ).values_list("pk", flat=True) - ] + allowed_object_ids = get_allowed_object_ids(self.request, indexed_models) queryset = queryset.filter(id__in=allowed_object_ids)