From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Fri, 12 May 2023 20:35:45 +0000 (-0700)
Subject: Merge pull request #3359 from paperless-ngx/feature-fix-autocomplete-respect-perms
X-Git-Tag: v1.14.5~1^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=350c20d6ab8a8afa749560f1ce6d101b70d81d7c;p=thirdparty%2Fpaperless-ngx.git

Merge pull request #3359 from paperless-ngx/feature-fix-autocomplete-respect-perms

Fix: respect permissions for autocomplete suggestions
---

350c20d6ab8a8afa749560f1ce6d101b70d81d7c
diff --cc src/documents/index.py
index 087329f9af,0c2bd1bfe0..054a931e09
--- a/src/documents/index.py
+++ b/src/documents/index.py
@@@ -238,29 -241,11 +243,23 @@@ class DelayedQuery
                  for storage_path_id in v.split(","):
                      criterias.append(query.Not(query.Term("path_id", storage_path_id)))
              elif k == "storage_path__isnull":
 -                criterias.append(query.Term("has_path", v == "false"))
 +                criterias.append(query.Term("has_path", self.evalBoolean(v) is False))
 +            elif k == "owner__isnull":
 +                criterias.append(query.Term("has_owner", self.evalBoolean(v) is False))
 +            elif k == "owner__id":
 +                criterias.append(query.Term("owner_id", v))
 +            elif k == "owner__id__in":
 +                owners_in = []
 +                for owner_id in v.split(","):
 +                    owners_in.append(query.Term("owner_id", owner_id))
 +                criterias.append(query.Or(owners_in))
 +            elif k == "owner__id__none":
 +                for owner_id in v.split(","):
 +                    criterias.append(query.Not(query.Term("owner_id", owner_id)))
  
-         user_criterias = [query.Term("has_owner", False)]
-         if "user" in self.query_params:
-             if self.query_params["is_superuser"]:  # superusers see all docs
-                 user_criterias = []
-             else:
-                 user_criterias.append(query.Term("owner_id", self.query_params["user"]))
-                 user_criterias.append(
-                     query.Term("viewer_id", str(self.query_params["user"])),
-                 )
+         user_criterias = get_permissions_criterias(
+             user=self.user,
+         )
          if len(criterias) > 0:
              if len(user_criterias) > 0:
                  criterias.append(query.Or(user_criterias))