do not allow find filename if not canSeeFiles

2011-10-30 15:48:46 +01:00 · 2011-10-30 15:48:46 +01:00 · 66c0cea928
parent a9d9a7ca63
commit 66c0cea928
1 changed files with 4 additions and 0 deletions
--- a/pandora/item/managers.py
+++ b/pandora/item/managers.py
@ -45,6 +45,10 @@ def parseCondition(condition, user):
        else:
            return q

+    if k == 'filename' and user.is_anonymous() or \
+        not user.get_profile().capability('canSeeFiles'):
+        return Q(id=0)
+
    key_type = settings.CONFIG['keys'].get(k, {'type':'string'}).get('type')
    if isinstance(key_type, list):
        key_type = key_type[0]