diff --git a/awx/api/views.py b/awx/api/views.py index 0519b32625..dc41a92f1a 100644 --- a/awx/api/views.py +++ b/awx/api/views.py @@ -366,6 +366,16 @@ class TeamActivityStreamList(SubListAPIView): parent_model = Team relationship = 'activitystream_set' + def get_queryset(self): + parent = self.get_parent_object() + self.check_parent_access(parent) + qs = self.request.user.get_queryset(self.model) + return qs.filter(Q(team=parent) | + Q(project__in=parent.projects.all()) | + Q(credential__in=parent.credentials.all()) | + Q(permission__in=parent.permissions.all())) + + class ProjectList(ListCreateAPIView): model = Project @@ -411,6 +421,13 @@ class ProjectActivityStreamList(SubListAPIView): parent_model = Project relationship = 'activitystream_set' + def get_queryset(self): + parent = self.get_parent_object() + self.check_parent_access(parent) + qs = self.request.user.get_queryset(self.model) + return qs.filter(Q(project=parent) | Q(credential__in=parent.credential)) + + class ProjectUpdatesList(SubListAPIView): model = ProjectUpdate @@ -609,6 +626,13 @@ class InventoryActivityStreamList(SubListAPIView): parent_model = Inventory relationship = 'activitystream_set' + def get_queryset(self): + parent = self.get_parent_object() + self.check_parent_access(parent) + qs = self.request.user.get_queryset(self.model) + return qs.filter(Q(inventory=parent) | Q(host__in=parent.hosts.all()) | Q(group__in=parent.groups.all())) + + class HostList(ListCreateAPIView): model = Host @@ -657,6 +681,13 @@ class HostActivityStreamList(SubListAPIView): parent_model = Host relationship = 'activitystream_set' + def get_queryset(self): + parent = self.get_parent_object() + self.check_parent_access(parent) + qs = self.request.user.get_queryset(self.model) + return qs.filter(Q(host=parent) | Q(inventory=parent.inventory)) + + class GroupList(ListCreateAPIView): model = Group @@ -742,6 +773,11 @@ class GroupActivityStreamList(SubListAPIView): parent_model = Group relationship = 'activitystream_set' + def get_queryset(self): + parent = self.get_parent_object() + self.check_parent_access(parent) + qs = self.request.user.get_queryset(self.model) + return qs.filter(Q(group=parent) | Q(host__in=parent.hosts.all())) class GroupDetail(RetrieveUpdateDestroyAPIView):