From 4c3ca0de912fdde54ef927a8e51ed5a349e5b692 Mon Sep 17 00:00:00 2001 From: Roberto Rosario Date: Thu, 23 Aug 2018 03:34:49 -0400 Subject: [PATCH] In addition to the document view permission, the checkout detail view permission is now needed to view the list of checked out document. Signed-off-by: Roberto Rosario --- HISTORY.rst | 3 +++ mayan/apps/checkouts/views.py | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/HISTORY.rst b/HISTORY.rst index f9af9942ff..2fdf16c8d1 100644 --- a/HISTORY.rst +++ b/HISTORY.rst @@ -100,6 +100,9 @@ - Add new class based dashboard widget. This new widget supports subclassing and is template based. All exising widgets have been converted. ACL filtering was added to the widget results. +- In addition to the document view permission, the checkout detail + view permission is now needed to view the list of checked out + document. 3.0.3 (2018-08-17) ================== diff --git a/mayan/apps/checkouts/views.py b/mayan/apps/checkouts/views.py index 761df9e9f2..8623bc7b73 100644 --- a/mayan/apps/checkouts/views.py +++ b/mayan/apps/checkouts/views.py @@ -72,7 +72,11 @@ class CheckoutDocumentView(SingleObjectCreateView): class CheckoutListView(DocumentListView): def get_document_queryset(self): - return DocumentCheckout.objects.checked_out_documents() + return AccessControlList.objects.filter_by_access( + permission=permission_document_checkout_detail_view, + user=self.request.user, + queryset=DocumentCheckout.objects.checked_out_documents() + ) def get_extra_context(self): context = super(CheckoutListView, self).get_extra_context()