diff --git a/zou/app/blueprints/assets/resources.py b/zou/app/blueprints/assets/resources.py index 8d349d22aa..3bdaa50f33 100644 --- a/zou/app/blueprints/assets/resources.py +++ b/zou/app/blueprints/assets/resources.py @@ -22,10 +22,10 @@ def check_criterion_access(criterions): episode_id = criterions.get("episode_id", None) project_id = shots_service.get_episode(episode_id)["project_id"] - if "is_shared" in criterions and project_id is None: - return permissions.check_manager_permissions() + if "project_id" in criterions: + user_service.check_project_access(project_id) - return user_service.check_project_access(project_id) + return True class AssetResource(Resource, ArgsMixin): @@ -110,7 +110,10 @@ def get(self): criterions["assigned_to"] = persons_service.get_current_user()[ "id" ] - return assets_service.get_assets(criterions) + return assets_service.get_assets( + criterions, + is_admin=permissions.has_admin_permissions(), + ) class AllAssetsAliasResource(AllAssetsResource): diff --git a/zou/app/services/assets_service.py b/zou/app/services/assets_service.py index 4139dee6c0..af3e7812f7 100644 --- a/zou/app/services/assets_service.py +++ b/zou/app/services/assets_service.py @@ -84,7 +84,7 @@ def build_entity_type_asset_type_filter(): return ~EntityType.id.in_(ids_to_exclude) -def get_assets(criterions={}): +def get_assets(criterions={}, is_admin=False): """ Get all assets for given criterions. """ @@ -102,6 +102,12 @@ def get_assets(criterions={}): query = query.outerjoin(Task) query = query.filter(user_service.build_assignee_filter()) + if "is_shared" in criterions: + if not is_admin: + query = ( + query.join(Project).filter(user_service.build_team_filter()) + ) + if episode_id is not None: # Filter based on main episode. query = query.filter(Entity.source_id == episode_id) diff --git a/zou/app/utils/query.py b/zou/app/utils/query.py index f78de28775..2e45b321cf 100644 --- a/zou/app/utils/query.py +++ b/zou/app/utils/query.py @@ -61,6 +61,7 @@ def apply_criterions_to_db_query(model, db_query, criterions): ) else: filters[key] = cast_value(value, field_key) + if filters: db_query = db_query.filter_by(**filters)