show only allowed related views

Author: gugupy

flask_appbuilder/baseviews.py

@@ -679,6 +679,8 @@ class MyView(ModelView):
     """
     _related_views = None
     """ internal list with ref to instantiated view classes """
+    allowed_related_views = None
+    """ Holds related views where the user has 'can_list' permission. """
     list_title = ""
     """ List Title, if not configured the default is 'List ' with pretty model name """
     show_title = ""
@@ -1032,13 +1034,15 @@ def _get_related_views_widgets(
             Model View widgets
         """
         widgets = widgets or {}
+        self.allowed_related_views = []
         widgets["related_views"] = []
         for view in self._related_views:
             # Skip related views if the current user does not have 'can_list' permission
             if not self.appbuilder.sm.has_access("can_list", view.__class__.__name__):
-                self._related_views.remove(view)
                 continue
 
+            self.allowed_related_views.append(view)
+
             if orders.get(view.__class__.__name__):
                 order_column, order_direction = orders.get(view.__class__.__name__)
             else:

flask_appbuilder/views.py

@@ -571,7 +571,7 @@ def show(self, pk):
             pk=pk,
             title=self.show_title,
             widgets=widgets,
-            related_views=self._related_views,
+            related_views=self.allowed_related_views,
         )
 
     """
@@ -609,7 +609,7 @@ def edit(self, pk):
                 self.edit_template,
                 title=self.edit_title,
                 widgets=widgets,
-                related_views=self._related_views,
+                related_views=self.allowed_related_views,
             )
 
     """
@@ -731,7 +731,7 @@ def list(self, pk=None):
             widgets = self._get_related_views_widgets(
                 item, orders=orders, pages=pages, page_sizes=page_sizes, widgets=widgets
             )
-            related_views = self._related_views
+            related_views = self.allowed_related_views
         else:
             related_views = []