Compare commits

..

1 Commits

Author SHA1 Message Date
Sli
b9b96767b9 Fix hidden user can't search itself 2026-04-18 18:09:14 +02:00
2 changed files with 17 additions and 1 deletions

View File

@@ -131,7 +131,9 @@ class UserQuerySet(models.QuerySet):
if user.has_perm("core.view_hidden_user"):
return self
if user.has_perm("core.view_user"):
return self.filter(Q(is_viewable=True) | Q(whitelisted_users=user))
return self.filter(
Q(is_viewable=True) | Q(whitelisted_users=user) | Q(pk=user.pk)
)
if user.is_anonymous:
return self.none()
return self.filter(id=user.id)

View File

@@ -417,12 +417,26 @@ class TestUserQuerySetViewableBy:
viewable = User.objects.filter(id__in=[u.id for u in users]).viewable_by(user)
assert set(viewable) == {users[0], users[1]}
def test_hidden(self, users: list[User]):
user = subscriber_user.make()
viewable = User.objects.filter(
id__in=[u.id for u in [*users, user]]
).viewable_by(user)
assert set(viewable) == {user, users[0], users[1]}
def test_whitelist(self, users: list[User]):
user = subscriber_user.make()
users[3].whitelisted_users.add(user)
viewable = User.objects.filter(id__in=[u.id for u in users]).viewable_by(user)
assert set(viewable) == {users[0], users[1], users[3]}
def test_hidden_user_can_see_itself(self, users: list[User]):
user = subscriber_user.make(is_viewable=False)
viewable = User.objects.filter(
id__in=[u.id for u in [*users, user]]
).viewable_by(user)
assert set(viewable) == {user, users[0], users[1]}
@pytest.mark.parametrize("user_factory", [lambda: baker.make(User), AnonymousUser])
def test_not_subscriber(self, users: list[User], user_factory):
user = user_factory()