Repository: fossasia/open-event-server

Issue:
Event role Attendee can see going events at /events, also shown in roles
Attendee is able to access the event they have bought the tickets for at /events . 

Also they are shown in the roles list. (I (Avi Aryan) am just an attendee in the following event)

![attendee_roles](https://cloud.githubusercontent.com/assets/4047597/17635947/e09d9baa-60f7-11e6-852c-7289c9dff027.png)



Discussion:

Resolving patch:
diff --git a/app/helpers/data_getter.py b/app/helpers/data_getter.py
--- a/app/helpers/data_getter.py
+++ b/app/helpers/data_getter.py
@@ -377,7 +377,7 @@ def get_user_events():
     def get_completed_events():
         events = Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
             .filter(Event.state == 'Completed')
-        return events
+        return DataGetter.trim_attendee_events(events)
 
     @staticmethod
     def get_all_published_events(include_private=False):
@@ -407,34 +407,44 @@ def get_call_for_speakers_events(include_private=False):
                     results.append(e)
         return results[:12]
 
+    @staticmethod
+    def trim_attendee_events(events):
+        """
+        return only those events where current_user has non-attendee permissions access
+        """
+        return [_ for _ in events if _.has_staff_access()]
+
     @staticmethod
     def get_published_events():
         events = Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
             .filter(Event.state == 'Published')
-        return events
+        return DataGetter.trim_attendee_events(events)
 
     @staticmethod
     def get_current_events():
         events = Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
             .filter(Event.state != 'Completed')
-        return events
+        return DataGetter.trim_attendee_events(events)
 
     @staticmethod
     def get_live_events():
-        return Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
+        events = Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
             .filter(Event.start_time >= datetime.datetime.now()).filter(Event.end_time >= datetime.datetime.now()) \
             .filter(Event.state == 'Published').filter(Event.in_trash == False)
+        return DataGetter.trim_attendee_events(events)
 
     @staticmethod
     def get_draft_events():
-        return Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
+        events = Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
             .filter(Event.state == 'Draft').filter(Event.in_trash == False)
+        return DataGetter.trim_attendee_events(events)
 
     @staticmethod
     def get_past_events():
-        return Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
+        events = Event.query.join(Event.roles, aliased=True).filter_by(user_id=login.current_user.id) \
             .filter(Event.end_time <= datetime.datetime.now()).filter(
             or_(Event.state == 'Completed', Event.state == 'Published')).filter(Event.in_trash == False)
+        return DataGetter.trim_attendee_events(events)
 
     @staticmethod
     def get_all_live_events():
diff --git a/app/models/event.py b/app/models/event.py
--- a/app/models/event.py
+++ b/app/models/event.py
@@ -10,6 +10,7 @@
 from app.helpers.versioning import clean_up_string, clean_html
 from custom_forms import CustomForms, session_form_str, speaker_form_str
 from app.models.email_notifications import EmailNotification
+from app.models.user import ATTENDEE
 from version import Version
 from . import db
 
@@ -195,6 +196,19 @@ def notification_settings(self):
         except:
             return None
 
+    def has_staff_access(self):
+        """does user have role other than attendee"""
+        access = False
+        for _ in self.roles:
+            if _.user_id == login.current_user.id:
+                if _.role.name != ATTENDEE:
+                    access = True
+        return access
+
+    def get_staff_roles(self):
+        """returns only roles which are staff i.e. not attendee"""
+        return [role for role in self.roles if role.role.name != ATTENDEE]
+
     @property
     def serialize(self):
         """Return object data in easily serializable format"""


Test patch: