Limit collections in image/document chooser based on permissions

Summary

When a user is assigned to a group with permissions to add/edit images and/or documents to a collection named “Collection One”, the chooser still has a select with options for all collections.

Quick and dirty solution:

wagtail/images/views/chooser.py

def chooser(request):
	...
	collections = None
	groups = request.user.groups.all()
	if groups:
		collection_permissions = GroupCollectionPermission.objects.filter(group__in=groups)
		if collection_permissions:
			collections = [cp.collection for cp in collection_permissions.all()]

	if not collections:
		collections = Collection.objects.all()
	
	if len(collections) < 2:
		collections = None

	...

Technical details

• Python version: 3.6.4.
• Django version: 2.0.4.
• Wagtail version: 2.0.1.

[coredumperror]

Hoo boy, it took me a looong time to circle back to this one. But I’m finally working on this. No clue yet how long it’ll take, but as of today it’s my primary focus.

[gasman]

@coredumperror That plan sounds good to me! I’d just change one detail:

a data migration that creates a choose permission on the Root collection for every existing Group.

should be: “every existing Group that has the ‘can access Wagtail admin’ (wagtailadmin.access_admin) permission”. (Functionally this is no different, since groups with no access to the Wagtail admin obviously won’t be able to access the chooser UI at all - but if there happen to be a large number of non-Wagtail-related groups on the system, we wouldn’t want to create redundant permission records for them all.)

I think we’d still need to mention the new permission in the ‘upgrade considerations’ section of the release notes, for the benefit of developers who are creating groups programmatically or through fixtures and will need to update their code accordingly.