From 5506df0cc648d8075b3de8b02b4e5ac8b3f9c22d Mon Sep 17 00:00:00 2001
From: wendrul <53628737+wendrul@users.noreply.github.com>
Date: Mon, 27 May 2024 15:58:07 +0200
Subject: [PATCH] fix: filtering not always working with concurrency keys
 (#3823)

* fix missing filtering on ommision of obscured jobs

Also allow cron and scheduled jobs for the filtering security

* Revert incorrect change

* Revert frontend change
---
 .../windmill-api/src/concurrency_groups.rs    | 42 ++++++++-----------
 1 file changed, 18 insertions(+), 24 deletions(-)

diff --git a/backend/windmill-api/src/concurrency_groups.rs b/backend/windmill-api/src/concurrency_groups.rs
index 8ddf3f0d0f..89954fc848 100644
--- a/backend/windmill-api/src/concurrency_groups.rs
+++ b/backend/windmill-api/src/concurrency_groups.rs
@@ -197,10 +197,10 @@ async fn get_concurrent_intervals(
             args: None,
             result: None,
             tag: None,
-            scheduled_for_before_now: None,
             has_null_parent: None,
             label: None,
-            is_not_schedule: None,
+            scheduled_for_before_now: _,
+            is_not_schedule: _,
             started_before: _,
             started_after: _,
             created_before: _,
@@ -221,28 +221,20 @@ async fn get_concurrent_intervals(
     // the workspace.
     // To avoid infering information through filtering, don't return obscured
     // jobs if the filters are too specific
-    if should_fetch_obscured_jobs {
-        let (sqlb_q, sqlb_c) = if w_id != "admin" {
-            // By default get obscured jobs from all workspaces, unless in
-            // admin workspace where admins can select to get all or not
-            (
-                filter_list_queue_query(
-                    sqlb_q,
-                    &ListQueueQuery { all_workspaces: Some(true), ..lqq.clone() },
-                    "admins",
-                ),
-                filter_list_completed_query(
-                    sqlb_c,
-                    &ListCompletedQuery { all_workspaces: Some(true), ..lq.clone() },
-                    "admins",
-                ),
-            )
-        } else {
-            (
-                filter_list_queue_query(sqlb_q, &lqq, w_id.as_str()),
-                filter_list_completed_query(sqlb_c, &lq, w_id.as_str()),
-            )
-        };
+    if should_fetch_obscured_jobs && w_id != "admins"{
+        // Get the obscured jobs from all workspaces (concurrency key could be global)
+        let (sqlb_q, sqlb_c) = (
+            filter_list_queue_query(
+                sqlb_q,
+                &ListQueueQuery { all_workspaces: Some(true), ..lqq.clone() },
+                "admins",
+            ),
+            filter_list_completed_query(
+                sqlb_c,
+                &ListCompletedQuery { all_workspaces: Some(true), ..lq.clone() },
+                "admins",
+            ),
+        );
 
         sqlb_q_user = filter_list_queue_query(sqlb_q_user, &lqq, w_id.as_str());
         sqlb_c_user = filter_list_completed_query(sqlb_c_user, &lq, w_id.as_str());
@@ -311,6 +303,8 @@ async fn get_concurrent_intervals(
             omitted_obscured_jobs: !should_fetch_obscured_jobs,
         }))
     } else {
+        sqlb_q = filter_list_queue_query(sqlb_q, &lqq, w_id.as_str());
+        sqlb_c = filter_list_completed_query(sqlb_c, &lq, w_id.as_str());
         let sql_q = sqlb_q.query()?;
         let sql_c = sqlb_c.query()?;