quick-filter: make sure we always apply IN filter query. Otherwise we can

end up iwth empty query which disables the ACL filter.

rhodecode/apps/home/views.py

@@ -104,7 +104,7 @@ class HomeView(BaseAppView):
     def _get_repo_list(self, name_contains=None, repo_type=None, limit=20):
         allowed_ids = self._rhodecode_user.repo_acl_ids(
             ['repository.read', 'repository.write', 'repository.admin'],
-            cache=False, name_filter=name_contains)
+            cache=False, name_filter=name_contains) or [-1]
 
         query = Repository.query()\
             .order_by(func.length(Repository.repo_name))\
@@ -139,7 +139,7 @@ class HomeView(BaseAppView):
     def _get_repo_group_list(self, name_contains=None, limit=20):
         allowed_ids = self._rhodecode_user.repo_group_acl_ids(
             ['group.read', 'group.write', 'group.admin'],
-            cache=False, name_filter=name_contains)
+            cache=False, name_filter=name_contains) or [-1]
 
         query = RepoGroup.query()\
             .order_by(func.length(RepoGroup.group_name))\

rhodecode/model/db.py

@@ -122,6 +122,11 @@ def in_filter_generator(qry, items, limit=500):
             *in_filter_generator(Repository.repo_id, range(100000))
         )).count()
     """
+    if not items:
+        # empty list will cause empty query which might cause security issues
+        # this can lead to hidden unpleasant results
+        items = [-1]
+
     parts = []
     for chunk in xrange(0, len(items), limit):
         parts.append(