diff --git a/awx/main/access.py b/awx/main/access.py index 2df99e7d26..e8dbd0fc59 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -1956,7 +1956,7 @@ class LabelAccess(BaseAccess): def get_queryset(self): if self.user.is_superuser or self.user.is_system_auditor: return self.model.objects.all() - return self.model.objects.filter( + return self.model.objects.all().filter( organization__in=Organization.accessible_objects(self.user, 'read_role') ) diff --git a/awx/main/tests/functional/test_rbac_label.py b/awx/main/tests/functional/test_rbac_label.py index 57700d17e2..d10e48ed0a 100644 --- a/awx/main/tests/functional/test_rbac_label.py +++ b/awx/main/tests/functional/test_rbac_label.py @@ -6,8 +6,9 @@ from awx.main.access import ( @pytest.mark.django_db def test_label_get_queryset_user(label, user): - access = LabelAccess(user('user', False)) - label.organization.member_role.members.add(user('user', False)) + u = user('user', False) + access = LabelAccess(u) + label.organization.member_role.members.add(u) assert access.get_queryset().count() == 1 @pytest.mark.django_db