mirror of
https://github.com/ansible/awx.git
synced 2026-01-13 11:00:03 -03:30
restrict queryset for access_list to visable users
This commit is contained in:
parent
69c994bd16
commit
54fa11cf25
@ -515,4 +515,4 @@ class ResourceAccessList(ListAPIView):
|
||||
ancestors = set()
|
||||
for r in roles:
|
||||
ancestors.update(set(r.ancestors.all()))
|
||||
return User.objects.filter(roles__in=list(ancestors)).distinct()
|
||||
return self.request.user.get_queryset(User).filter(roles__in=list(ancestors)).distinct()
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user