src/authentic2/api_views.py

@@ -1726,6 +1726,7 @@ class StatisticsAPI(ViewSet):
         }
 
         subfilters = []
+        allowed_filters = []
         if not method:
             method = {
                 'global': 'get_global_statistics',

tests/api/test_all.py

@@ -2949,6 +2949,14 @@ def test_api_statistics(app, admin, freezer, event_type_name, event_name):
         {'data': [1, 1], 'label': 'Second OU'},
     ]
 
+    # forbidden filter is ignored
+    resp = app.get(url, headers=headers, params={'service': 'portal second', **params})
+    assert resp.json['data']['x_labels'] == ['2020-02', '2020-03']
+    assert resp.json['data']['series'] == [
+        {'data': [1, 1], 'label': 'Default organizational unit'},
+        {'data': [1, 1], 'label': 'Second OU'},
+    ]
+
     if 'new' in event_name:
         del params['group_by']