mirror of
https://github.com/ansible/awx.git
synced 2026-03-06 19:21:06 -03:30
restrict queryset for access_list to visable users
This commit is contained in:
@@ -515,4 +515,4 @@ class ResourceAccessList(ListAPIView):
|
||||
ancestors = set()
|
||||
for r in roles:
|
||||
ancestors.update(set(r.ancestors.all()))
|
||||
return User.objects.filter(roles__in=list(ancestors)).distinct()
|
||||
return self.request.user.get_queryset(User).filter(roles__in=list(ancestors)).distinct()
|
||||
|
||||
Reference in New Issue
Block a user