Fixed #1756 -- hide unpublished events from side menus for staff

[ontowhee]

Fixed #1756. Only return published events, even for staff users.

[bmispelon]

Thanks for the PR, nice work! 🎸

The code change looks good, I just had a note about the test (I like the use of assertQuerySetEqual on response.context["events"] by the way, that seems like a robust and effective way to test what we want here 👍🏻 ).

[bmispelon]

This new test already passes with the old version of the code, because it's not useing a logged-in staff user.
I suggest to test things with three types of users: anonymous (not logged in), logged in (not staff), and logged in (staff). Something like this should work (not tested):

Suggested change

	response = self.client.get(reverse("weblog:index"))
	self.assertEqual(response.status_code, 200)
	self.assertQuerySetEqual(response.context["events"], [])
	for user in [
	None,
	User.objects.create(is_staff=False),
	User.objects.create(is_staff=True),
	]:
	if user:
	self.client.force_login(user)
	response = self.client.get(reverse("weblog:index"))
	with self.subTest(user=user):
	self.assertEqual(response.status_code, 200)
	self.assertQuerySetEqual(response.context["events"], [])

[ontowhee]

Thank you for these tests! I didn't think to check the anonymous, staff, and non-staff users. I've added these cases along with a superuser for good measure!

[bmispelon]

Excellent, nice work 👍🏻

[jefftriplett]

@ontowhee awesome work. Thank you!