Skip to content

Commit

Permalink
Allow superusers to list all org members (#4593)
Browse files Browse the repository at this point in the history
Fix bug that prevents superusers from listing members of an org that the superuser does not belong to
  • Loading branch information
axelstudios committed Mar 28, 2024
1 parent 88ed0e4 commit 77b9e4a
Showing 1 changed file with 12 additions and 7 deletions.
19 changes: 12 additions & 7 deletions seed/views/v3/organization_users.py
Original file line number Diff line number Diff line change
Expand Up @@ -41,14 +41,19 @@ def list(self, request, organization_pk):
'message': 'Could not retrieve organization at organization_pk = ' + str(organization_pk)},
status=status.HTTP_404_NOT_FOUND)

org_user = OrganizationUser.objects.get(user=self.request.user, organization=org)
is_member = org_user.role_level >= ROLE_MEMBER
if request.user.is_superuser:
is_member_or_superuser = True
org_users = org.organizationuser_set.all()
else:
org_user = OrganizationUser.objects.get(user=self.request.user, organization=org)
is_member_or_superuser = org_user.role_level >= ROLE_MEMBER

org_users = org.organizationuser_set.filter(
access_level_instance__rgt__lte=org_user.access_level_instance.rgt,
access_level_instance__lft__gte=org_user.access_level_instance.lft,
)

users = []
org_users = org.organizationuser_set.filter(
access_level_instance__rgt__lte=org_user.access_level_instance.rgt,
access_level_instance__lft__gte=org_user.access_level_instance.lft,
)
for u in org_users:
user = u.user
user_info = {
Expand All @@ -57,7 +62,7 @@ def list(self, request, organization_pk):
'last_name': user.last_name,
'user_id': user.pk,
}
if is_member:
if is_member_or_superuser:
user_orgs = OrganizationUser.objects.filter(user=user).count()
user_info.update({
'number_of_orgs': user_orgs,
Expand Down

0 comments on commit 77b9e4a

Please sign in to comment.