From 66c0cea92893519d91dcd9dda61cfbd2b5348fb7 Mon Sep 17 00:00:00 2001
From: j <0x006A@0x2620.org>
Date: Sun, 30 Oct 2011 15:48:46 +0100
Subject: [PATCH] do not allow find filename if not canSeeFiles

---
 pandora/item/managers.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pandora/item/managers.py b/pandora/item/managers.py
index b07dea68e..cb02745d0 100644
--- a/pandora/item/managers.py
+++ b/pandora/item/managers.py
@@ -45,6 +45,10 @@ def parseCondition(condition, user):
         else:
             return q
 
+    if k == 'filename' and user.is_anonymous() or \
+        not user.get_profile().capability('canSeeFiles'):
+        return Q(id=0)
+
     key_type = settings.CONFIG['keys'].get(k, {'type':'string'}).get('type')
     if isinstance(key_type, list):
         key_type = key_type[0]