Fix #1275: is_reviewed flag inconsistencies and media access control

[robsiera]

Fixes #1275

⚠️ Disclaimer

Note: I am not a Python programmer and this fix was developed with heavy assistance from AI tools. While the solution has been carefully analyzed, it has not been tested! So I recommend thorough code review by experienced Python/Django developers before merging.

Problem

The is_reviewed flag exhibited inconsistent behavior:

1. Public edit page incorrectly displayed is_reviewed as true when database value was false
2. Media with is_reviewed = false remained publicly accessible despite review settings

Root Cause Analysis

1. Form issue: is_reviewed field was completely removed from forms for non-editors using self.fields.pop("is_reviewed"), causing frontend display inconsistencies
2. Database sync issue: When updating is_reviewed via API, the listable field wasn't included in update_fields, so the recalculated value wasn't persisted to the database

Solution

1. files/forms.py: Make is_reviewed field readonly/disabled for non-editors instead of removing it entirely
2. files/views.py: Include listable in update_fields when updating is_reviewed to ensure the recalculated value is saved

Technical Details

• The listable field is recalculated in the model's save() method based on state, encoding_status, and is_reviewed
• Using update_fields=["is_reviewed"] only persists the is_reviewed change, ignoring the recalculated listable value
• This created a desync where is_reviewed=False but listable=True, allowing unintended public access

Testing

• Edit page now shows correct review status for all user types
• Non-reviewed media are properly filtered from public access
• Review status changes via API now properly update access control
• Existing functionality for editors/managers remains unchanged

Request for Review

Given my limited Python/Django experience, I especially welcome feedback on:

• Django best practices for form field handling
• Proper use of update_fields parameter
• Any potential edge cases or security implications

[mgogoulos]

hi, can you sync with main branch? there have been a few changes. I think the change in files/forms.py is not needed anymore, so probably keep the change in views.py only.
Thanks

[robsiera]

beter like this?

[mgogoulos]

There has been a refactoring ad files/views.py has been removed, views are now inside files/views/ .

If you want feel free to resubmit by editing files/views/media.py