diff --git a/ippisite/ippidb/views/compound_query.py b/ippisite/ippidb/views/compound_query.py index 12c8b66e552e2caa62f2889e2734399dcbcaaabf..b49ebac42d3386bbc45e3aabf01ee256dad1b41a 100644 --- a/ippisite/ippidb/views/compound_query.py +++ b/ippisite/ippidb/views/compound_query.py @@ -564,6 +564,16 @@ class CompoundListView(ListView): self.filter_context = {} # get queryset qs = super().get_queryset() + # compounds can be accessed only if they are validated or + # if the current user is an admin OR their contributor + current_user = self.request.user + if current_user.is_anonymous: + qs = qs.exclude(compoundaction__ppi__contribution__validated=False) + elif not current_user.is_superuser: + qs = qs.exclude( + Q(compoundaction__ppi__contribution__validated=False), + ~Q(compoundaction__ppi__contribution__contributor=current_user), + ) # add filters self.filter_context[ "disabled"