From 42117ffb8e2854f04670d241f303ed276afee8cc Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 29 Jul 2017 22:44:25 +0200 Subject: [PATCH] user-group-admin: use a proper auth filter. - we now use an full sql based perm check based on an earlier fetch of allowed IDS - fixes problem with sql limit/filter and later filterint that by auth. - can be optimized later --- rhodecode/apps/admin/views/user_groups.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/rhodecode/apps/admin/views/user_groups.py b/rhodecode/apps/admin/views/user_groups.py index 902f287f..cd2eea5f 100644 --- a/rhodecode/apps/admin/views/user_groups.py +++ b/rhodecode/apps/admin/views/user_groups.py @@ -89,7 +89,16 @@ class AdminUserGroupsView(BaseAppView, DataGridAppView): def user_profile(username): return _render('user_profile', username) - user_groups_data_total_count = UserGroup.query().count() + auth_user_group_list = UserGroupList( + UserGroup.query().all(), perm_set=['usergroup.admin']) + + allowed_ids = [] + for user_group in auth_user_group_list: + allowed_ids.append(user_group.users_group_id) + + user_groups_data_total_count = UserGroup.query()\ + .filter(UserGroup.users_group_id.in_(allowed_ids))\ + .count() member_count = count(UserGroupMember.user_id) base_q = Session.query( @@ -101,6 +110,7 @@ class AdminUserGroupsView(BaseAppView, DataGridAppView): User, member_count.label('member_count') ) \ + .filter(UserGroup.users_group_id.in_(allowed_ids)) \ .outerjoin(UserGroupMember) \ .join(User, User.user_id == UserGroup.user_id) \ .group_by(UserGroup, User) @@ -130,9 +140,7 @@ class AdminUserGroupsView(BaseAppView, DataGridAppView): base_q = base_q.offset(start).limit(limit) # authenticated access to user groups - user_group_list = base_q.all() - auth_user_group_list = UserGroupList( - user_group_list, perm_set=['usergroup.admin']) + auth_user_group_list = base_q.all() user_groups_data = [] for user_gr in auth_user_group_list: