Merge pull request #5878 from escattone/exclude-restricted-articles-f…

…rom-what-links-here-page

exclude restricted articles from what-links-here page

kitsune/wiki/tests/test_views.py

@@ -12,7 +12,7 @@
 from kitsune.sumo.redis_utils import RedisError, redis_client
 from kitsune.sumo.tests import SkipTest, TestCase, template_used
 from kitsune.sumo.urlresolvers import reverse
-from kitsune.users.tests import UserFactory, add_permission
+from kitsune.users.tests import GroupFactory, UserFactory, add_permission
 from kitsune.wiki.config import CATEGORIES, TEMPLATE_TITLE_PREFIX, TEMPLATES_CATEGORY
 from kitsune.wiki.models import (
     Document,
@@ -1507,13 +1507,28 @@ def test_json_view_404(self):
 
 class WhatLinksWhereTests(TestCase):
     def test_what_links_here(self):
+        group = GroupFactory()
+        user = UserFactory(groups=[group])
         d1 = ApprovedRevisionFactory(content="", document__title="D1").document
-        ApprovedRevisionFactory(content="[[D1]]", document__title="D2").document
+        ApprovedRevisionFactory(content="[[D1]]", document__title="D2")
+        ApprovedRevisionFactory(
+            content="[[D1]]",
+            document__title="D3",
+            document__restrict_to_groups=[group],
+        )
 
         url = reverse("wiki.what_links_here", args=[d1.slug])
         resp = self.client.get(url, follow=True)
         self.assertEqual(200, resp.status_code)
         assert b"D2" in resp.content
+        assert b"D3" not in resp.content
+
+        self.client.login(username=user.username, password="testpass")
+        resp = self.client.get(url, follow=True)
+        self.client.logout()
+        self.assertEqual(200, resp.status_code)
+        assert b"D2" in resp.content
+        assert b"D3" in resp.content
 
     def test_what_links_here_locale_filtering(self):
         d1 = DocumentFactory(title="D1", locale="de")

kitsune/wiki/views.py

@@ -11,7 +11,7 @@
 from django.contrib.postgres.aggregates import ArrayAgg
 from django.core.cache import cache
 from django.core.exceptions import PermissionDenied
-from django.db.models import Count, Q
+from django.db.models import Count, Exists, OuterRef, Q
 from django.db.models.functions import Now, TruncDate
 from django.forms.utils import ErrorList
 from django.http import Http404, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect
@@ -1663,7 +1663,11 @@ def what_links_here(request, document_slug):
         return HttpResponseRedirect(url)
 
     links = {}
-    links_to = doc.links_to().select_related("linked_from")
+    links_to = (
+        doc.links_to()
+        .filter(Exists(Document.objects.visible(request.user, id=OuterRef("linked_from"))))
+        .select_related("linked_from")
+    )
     for link_to in links_to:
         if doc.locale == link_to.linked_from.locale:
             if link_to.kind not in links: