From e814eede4c034acc38f6646e533ba69809adbe19 Mon Sep 17 00:00:00 2001 From: Seth Michael Larson Date: Tue, 28 Jul 2026 15:49:30 -0500 Subject: [PATCH 1/2] Only return public posts, not private --- apps/community/tests/test_views.py | 32 ++++++++++++++++++++++++++++++ apps/community/views.py | 6 ++++++ 2 files changed, 38 insertions(+) diff --git a/apps/community/tests/test_views.py b/apps/community/tests/test_views.py index 1d2bfb310..42c9a4ba6 100644 --- a/apps/community/tests/test_views.py +++ b/apps/community/tests/test_views.py @@ -1,3 +1,5 @@ +from django.test import TestCase + from apps.community.models import Post from pydotorg.tests.test_classes import TemplateTestCase @@ -9,3 +11,33 @@ def test_render_template_for(self): rendered = self.render_string(template, {"post": obj}) expected = '

todo: types/text.html - Post text ({0:d})

\n' self.assertEqual(rendered, expected.format(obj.pk)) + + +class PostListPrivateFilterTest(TestCase): + def setUp(self): + self.public_post = Post.objects.create( + title="Public Post", + content="visible", + media_type=Post.MEDIA_TEXT, + status=Post.STATUS_PUBLIC, + ) + self.private_post = Post.objects.create( + title="Private Post", + content="hidden", + media_type=Post.MEDIA_TEXT, + status=Post.STATUS_PRIVATE, + ) + + def test_post_list_excludes_private(self): + response = self.client.get("/community/") + self.assertEqual(response.status_code, 200) + self.assertIn(self.public_post, response.context["object_list"]) + self.assertNotIn(self.private_post, response.context["object_list"]) + + def test_post_detail_returns_404_for_private(self): + response = self.client.get(f"/community/{self.private_post.pk}/") + self.assertEqual(response.status_code, 404) + + def test_post_detail_returns_200_for_public(self): + response = self.client.get(f"/community/{self.public_post.pk}/") + self.assertEqual(response.status_code, 200) diff --git a/apps/community/views.py b/apps/community/views.py index 23f9f15a5..37e8b97af 100644 --- a/apps/community/views.py +++ b/apps/community/views.py @@ -11,8 +11,14 @@ class PostList(ListView): model = Post paginate_by = 25 + def get_queryset(self): + return Post.objects.public() + class PostDetail(DetailView): """Detail view for a single community post.""" model = Post + + def get_queryset(self): + return Post.objects.public() From e3ff2b56048925e7826b82ab1e70ecfb4a84c5ea Mon Sep 17 00:00:00 2001 From: Seth Michael Larson Date: Tue, 28 Jul 2026 16:26:36 -0500 Subject: [PATCH 2/2] lint --- apps/community/views.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/community/views.py b/apps/community/views.py index 37e8b97af..d858dfefa 100644 --- a/apps/community/views.py +++ b/apps/community/views.py @@ -12,6 +12,7 @@ class PostList(ListView): paginate_by = 25 def get_queryset(self): + """Only return public posts.""" return Post.objects.public() @@ -21,4 +22,5 @@ class PostDetail(DetailView): model = Post def get_queryset(self): + """Only return public posts.""" return Post.objects.public()