Update user management app user group view and add API to filter

by group permission too. At the moment the group view permission
is required to add a group to an existing user. This should be
updated to a new specific group permission (ie: group_add, group_remove).

Signed-off-by: Michael Price <loneviking72@gmail.com>

mayan/apps/user_management/api_views.py

@@ -217,10 +217,21 @@ class APIUserGroupList(generics.ListCreateAPIView):
         )
 
     def get_user(self):
-        return get_object_or_404(get_user_model(), pk=self.kwargs['pk'])
+        if self.request.method == 'GET':
+            permission = permission_user_view
+        else:
+            permission = permission_user_edit
+
+        user = get_object_or_404(get_user_model(), pk=self.kwargs['pk'])
+
+        AccessControlList.objects.check_access(
+            permissions=(permission,), user=self.request.user,
+            obj=user
+        )
+        return user
 
     def perform_create(self, serializer):
-        serializer.save(user=self.get_user())
+        serializer.save(user=self.get_user(), _user=self.request.user)
 
     def post(self, request, *args, **kwargs):
         """