From 692ed81306ba3f2398294d3140bd7fe80fdf1856 Mon Sep 17 00:00:00 2001
From: Miroslav Prasil <miroslav@prasil.info>
Date: Fri, 13 Jul 2018 17:21:19 +0100
Subject: [PATCH] Do not show organization stuff to not accepted user

---
 README.md                     | 4 +++-
 src/db/models/collection.rs   | 7 ++++++-
 src/db/models/organization.rs | 1 +
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f78e15be..be2b1623 100644
--- a/README.md
+++ b/README.md
@@ -4,8 +4,10 @@ Image is based on [Rust implementation of Bitwarden API](https://github.com/dani
 
 _*Note, that this project is not associated with the [Bitwarden](https://bitwarden.com/) project nor 8bit Solutions LLC._
 
-## Table of contents <!-- omit in toc -->
+**Table of contents**
+
 - [Features](#features)
+- [Missing features](#missing-features)
 - [Docker image usage](#docker-image-usage)
   - [Starting a container](#starting-a-container)
   - [Updating the bitwarden image](#updating-the-bitwarden-image)
diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs
index ed741ba0..fa16ec28 100644
--- a/src/db/models/collection.rs
+++ b/src/db/models/collection.rs
@@ -2,7 +2,7 @@ use serde_json::Value as JsonValue;
 
 use uuid::Uuid;
 
-use super::{Organization, UserOrganization, UserOrgType};
+use super::{Organization, UserOrganization, UserOrgType, UserOrgStatus};
 
 #[derive(Debug, Identifiable, Queryable, Insertable, Associations)]
 #[table_name = "collections"]
@@ -78,13 +78,18 @@ impl Collection {
     pub fn find_by_user_uuid(user_uuid: &str, conn: &DbConn) -> Vec<Self> {
         let mut all_access_collections = users_organizations::table
             .filter(users_organizations::user_uuid.eq(user_uuid))
+            .filter(users_organizations::status.eq(UserOrgStatus::Confirmed as i32))
             .filter(users_organizations::access_all.eq(true))
             .inner_join(collections::table.on(collections::org_uuid.eq(users_organizations::org_uuid)))
             .select(collections::all_columns)
             .load::<Self>(&**conn).expect("Error loading collections");
 
         let mut assigned_collections = users_collections::table.inner_join(collections::table)
+            .left_join(users_organizations::table.on(
+                users_collections::user_uuid.eq(users_organizations::user_uuid)
+            ))
             .filter(users_collections::user_uuid.eq(user_uuid))
+            .filter(users_organizations::status.eq(UserOrgStatus::Confirmed as i32))
             .select(collections::all_columns)
             .load::<Self>(&**conn).expect("Error loading collections");
 
diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs
index 9608708f..4bb55912 100644
--- a/src/db/models/organization.rs
+++ b/src/db/models/organization.rs
@@ -268,6 +268,7 @@ impl UserOrganization {
     pub fn find_by_user(user_uuid: &str, conn: &DbConn) -> Vec<Self> {
         users_organizations::table
             .filter(users_organizations::user_uuid.eq(user_uuid))
+            .filter(users_organizations::status.eq(UserOrgStatus::Confirmed as i32))
             .load::<Self>(&**conn).unwrap_or(vec![])
     }