openwisp-users
openwisp-users copied to clipboard
[bug] Objects from inactive organizations are visible to the user
The User.organizations_dict remains unaffected even when the status of the Organization.is_active attribute is modified. As a result, users can continue to access items from deactivated organizations until the cache expires. Conversely, if a previously disabled organization is reactivated, users are unable to retrieve objects associated with that organization.
Proposed Solution:
When the is_active status of an Organization changes, the User.organizations_dict cache should be invalidated for the related users.
django-organizations provides ActiveOrgManager (queryset manager) that only returns active organizations in the queryset.
For all non-admin views, we should use this querset manager. In the admin views, Organization.objects.filter(user.organizations_managed must take care of everything.
would like taking this up!