From 149e68b7e7746cb0611dd51182f8abf534fb0a41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9ters?= <fpeters@entrouvert.com>
Date: Mon, 3 Feb 2020 14:06:44 +0100
Subject: [PATCH] kb: limit last updated pages content to visible pages
 (#39484)

---
 combo/apps/kb/models.py |  6 +++++-
 tests/test_kb.py        | 28 ++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/combo/apps/kb/models.py b/combo/apps/kb/models.py
index 59b39a34..5f3208cf 100644
--- a/combo/apps/kb/models.py
+++ b/combo/apps/kb/models.py
@@ -15,6 +15,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import datetime
+import itertools
 
 from django.db import models
 from django.utils import timezone
@@ -42,5 +43,8 @@ class LatestPageUpdatesCell(CellBase):
             pages = self.root_page.get_descendants_and_me()
         else:
             pages = Page.objects.all()
-        extra_context['pages'] = pages.order_by('-last_update_timestamp')[:self.limit]
+        user = self.get_concerned_user(context)
+        extra_context['pages'] = itertools.islice(
+                (x for x in pages.order_by('-last_update_timestamp') if x.is_visible(user=user)),
+                self.limit)
         return extra_context
diff --git a/tests/test_kb.py b/tests/test_kb.py
index 4e126d72..edde9174 100644
--- a/tests/test_kb.py
+++ b/tests/test_kb.py
@@ -17,6 +17,8 @@
 import pytest
 import re
 
+from django.test.client import RequestFactory
+
 from combo.data.models import CellBase, Page, TextCell
 from combo.apps.kb.models import LatestPageUpdatesCell
 
@@ -135,3 +137,29 @@ def test_updated_pages_cell_root_page():
     Page.objects.get(slug='page-2').delete()
     cell = CellBase.get_cells(slug='me')[0]  # reload cell
     assert cell.render(ctx).count('<li') == 2
+
+
+def test_updated_pages_cell_visibility(freezer, admin_user):
+    Page.objects.all().delete()
+    page = Page(title='example page', slug='example-page')
+    page.save()
+    Page(title='second example page', slug='second-example-page').save()
+    Page(title='third example page', slug='third-example-page', public=False).save()
+    cell = LatestPageUpdatesCell(page=page, order=0)
+    cell.save()
+
+    request = RequestFactory().get('/')
+    request.user = None
+    ctx = {'request': request}
+    rendered = cell.render(ctx)
+    assert rendered.count('<a') == 2
+    assert '/example-page' in rendered
+    assert '/second-example-page' in rendered
+    assert '/third-example-page' not in rendered
+
+    request.user = admin_user
+    rendered = cell.render(ctx)
+    assert rendered.count('<a') == 3
+    assert '/example-page' in rendered
+    assert '/second-example-page' in rendered
+    assert '/third-example-page' in rendered