Fixed #1756 -- hide unpublished events from side menus for staff

blog/tests.py

@@ -2,6 +2,7 @@
 from datetime import timedelta
 from io import StringIO
 
+from django.contrib.auth.models import User
 from django.test import TestCase
 from django.urls import reverse
 from django.utils import timezone
@@ -191,6 +192,38 @@ def test_no_past_upcoming_events(self):
         self.assertEqual(response.status_code, 200)
         self.assertQuerySetEqual(response.context["events"], [])
 
+    def test_no_unpublished_future_events(self):
+        """
+        Make sure there are no unpublished future events in the "upcoming events" sidebar
+        """
+        # We need a published entry on the index page so that it doesn't return a 404
+        Entry.objects.create(pub_date=self.yesterday, is_active=True, slug="a")
+        Event.objects.create(
+            date=self.tomorrow,
+            pub_date=self.yesterday,
+            is_active=False,
+            headline="inactive",
+        )
+        Event.objects.create(
+            date=self.tomorrow,
+            pub_date=self.tomorrow,
+            is_active=True,
+            headline="future publish date",
+        )
+
+        for user in [
+            None,
+            User.objects.create(username="non-staff", is_staff=False),
+            User.objects.create(username="staff", is_staff=True),
+            User.objects.create_superuser(username="superuser"),
+        ]:
+            if user:
+                self.client.force_login(user)
+            response = self.client.get(reverse("weblog:index"))
+            with self.subTest(user=user):
+                self.assertEqual(response.status_code, 200)
+                self.assertQuerySetEqual(response.context["events"], [])
+
 
 class SitemapTests(DateTimeMixin, TestCase):
     def test_sitemap(self):

blog/views.py

@@ -25,9 +25,7 @@ def get_queryset(self):
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
 
-        events_queryset = Event.objects.future()
-        if not self.request.user.is_staff:
-            events_queryset = events_queryset.published()
+        events_queryset = Event.objects.future().published()
 
         context["events"] = events_queryset[:3]