diff --git a/mayan/apps/common/mixins.py b/mayan/apps/common/mixins.py index 307fa38089..e30ab10369 100644 --- a/mayan/apps/common/mixins.py +++ b/mayan/apps/common/mixins.py @@ -214,12 +214,25 @@ class ObjectActionMixin(object): class ObjectListPermissionFilterMixin(object): + """ + access_object_retrieve_method is have the entire view check against + an object permission and not the individual secondary items. + """ + access_object_retrieve_method = None object_permission = None + def dispatch(self, request, *args, **kwargs): + if self.access_object_retrieve_method and self.object_permission: + AccessControlList.objects.check_access( + permissions=(self.object_permission,), user=request.user, + obj=getattr(self, self.access_object_retrieve_method)() + ) + return super(ObjectListPermissionFilterMixin, self).dispatch(request, *args, **kwargs) + def get_queryset(self): queryset = super(ObjectListPermissionFilterMixin, self).get_queryset() - if self.object_permission: + if not self.get_document_type and self.object_permission: return AccessControlList.objects.filter_by_access( self.object_permission, self.request.user, queryset=queryset )