From 1fe05090c820c0d811176a5ee82af2e5571858f6 Mon Sep 17 00:00:00 2001
From: David Triglianos <davetrig@yahoo.com>
Date: Mon, 18 Dec 2017 10:23:30 -0500
Subject: [PATCH] Only apply public access filter on global collection
 membership search

---
 ocl/collection/filters.py | 1 -
 ocl/collection/views.py   | 7 ++++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/ocl/collection/filters.py b/ocl/collection/filters.py
index 2d388bc..85f194d 100644
--- a/ocl/collection/filters.py
+++ b/ocl/collection/filters.py
@@ -11,5 +11,4 @@ def get_filters(self, request, view):
             filters.update({'ownerType': view.parent_resource.resource_type()})
         else:
             filters.update({'public_can_view': True})
-
         return filters
diff --git a/ocl/collection/views.py b/ocl/collection/views.py
index a54c1bb..2a9dbfe 100644
--- a/ocl/collection/views.py
+++ b/ocl/collection/views.py
@@ -268,6 +268,7 @@ class CollectionListView(CollectionBaseView,
     serializer_class = CollectionCreateSerializer
     filter_backends = [CollectionSearchFilter]
     contains_uri = None
+    owner_specified = False
     solr_fields = {
         'collection_type': {'sortable': False, 'filterable': True},
         'name': {'sortable': True, 'filterable': False},
@@ -277,6 +278,7 @@ class CollectionListView(CollectionBaseView,
     }
 
     def get(self, request, *args, **kwargs):
+        self.owner_specified = (kwargs.__len__() > 0)
         self.serializer_class = CollectionDetailSerializer if self.is_verbose(request) else CollectionListSerializer
         self.contains_uri = request.QUERY_PARAMS.get('contains', None)
         # Running the filter_backends seems to reset changes made to the queryset.
@@ -295,7 +297,10 @@ def get_queryset(self):
         # TODO correct the behavior of filter_backends, and remove this hack to get around it
         if self.contains_uri != None:
             from django_mongodb_engine.query import A
-            queryset = queryset.filter(references=A('expression', self.contains_uri), public_access__in=[ACCESS_TYPE_EDIT, ACCESS_TYPE_VIEW])
+            if self.owner_specified:
+                queryset = queryset.filter(references=A('expression', self.contains_uri))
+            else:
+                queryset = queryset.filter(references=A('expression', self.contains_uri), public_access__in=[ACCESS_TYPE_EDIT, ACCESS_TYPE_VIEW])
         return queryset
 
     def get_csv_rows(self, queryset=None):