diff --git a/arkindex/project/mixins.py b/arkindex/project/mixins.py index c805ccd753702fdffae7a020be664382408aa056..94a41281c1dd218024ce481c87339cad6103524c 100644 --- a/arkindex/project/mixins.py +++ b/arkindex/project/mixins.py @@ -32,8 +32,15 @@ class ACLMixin(object): """ Return a model queryset matching a given access level for this user """ + # Handle specific cases (i.e. admin or anonymous user) if self.user.is_admin or self.user.is_internal: return model.objects.all() + elif user.is_anonymous: + if level > Role.Guest.value or not public: + return model.objects.none() + else: + return model.objects.filter(public=True) + queryset = model.objects \ .filter( # Filter instances with direct and groups rights for this user (They may be duplicated)