diff options
Diffstat (limited to 'ishtar_common/views_item.py')
| -rw-r--r-- | ishtar_common/views_item.py | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/ishtar_common/views_item.py b/ishtar_common/views_item.py index 7407eb37f..f2d0ffdd5 100644 --- a/ishtar_common/views_item.py +++ b/ishtar_common/views_item.py @@ -2038,7 +2038,7 @@ def _get_json_stats( return HttpResponse(data, content_type="application/json") -def _get_table_cols(data_type, own_table_cols, full, model): +def _get_table_cols(request, data_type, own_table_cols, full, model): # list of table cols depending on configuration and data send if data_type == "json-map": return [] # only pk for map @@ -2067,7 +2067,17 @@ def _get_table_cols(data_type, own_table_cols, full, model): if callable(table_cols): table_cols = table_cols() table_cols = list(table_cols) - return table_cols + if not hasattr(model, "TABLE_COLS_FILTERS"): + return table_cols + filtered_table_cols = [] + for col_name in table_cols: + for key in model.TABLE_COLS_FILTERS: + if not col_name.startswith(key) or \ + request.user.ishtaruser.has_permission( + model.TABLE_COLS_FILTERS[key] + ): + filtered_table_cols.append(col_name) + return filtered_table_cols def split_dict(dct): @@ -2691,7 +2701,7 @@ def get_item( return items items = items.distinct() - table_cols = _get_table_cols(data_type, own_table_cols, full, model) + table_cols = _get_table_cols(request, data_type, own_table_cols, full, model) count_values = ["pk"] query_distinct_count = getattr(model, "QUERY_DISTINCT_COUNT", None) @@ -2815,6 +2825,8 @@ def get_item( if col_num < 2 and len(sort_keys) <= 2: orders.append("pk") continue + if (col_num - 2) >= len(query_table_cols): + break k = query_table_cols[col_num - 2] if k in request_keys: ks = request_keys[k] |