patient view > display only available config

server/web2py/applications/vidjil/views/patient/info.html

@@ -127,15 +127,18 @@
 
     <div class="db_block_right">
         see the result:
-        {{for row in db(db.fused_file.patient_id == request.vars["id"]).select() :}}
-            {{filename = vidjil_utils.anon(request.vars["id"], auth.user_id) + " (" + db.config[row.config_id].name + ")"}}
-            {{if row.fused_file is not None :}}
-                <a class="button2" href="index.html?patient={{=request.vars["id"]}}&config={{=row.config_id}}" type="text/html"
+        {{for row in db( (db.fused_file.patient_id == request.vars["id"]) & 
+                         (auth.accessible_query('read', db.config) | auth.accessible_query('admin', db.config) ) &
+                         (db.config.id ==db.fused_file.config_id)
+                       ).select() :}}
+            {{filename = vidjil_utils.anon(request.vars["id"], auth.user_id) + " (" + row.config.name + ")"}}
+            {{if row.fused_file.fused_file is not None :}}
+                <a class="button2" href="index.html?patient={{=request.vars["id"]}}&config={{=row.config.id}}" type="text/html"
                       onclick="event.preventDefault()
                                if( event.which == 2 ) { window.open(this.href) }
-                               else { db.load_data( { 'patient' : '{{=request.vars["id"]}}' , 'config' : {{=row.config_id}} }, '{{=filename}}' ) }" >
+                               else { db.load_data( { 'patient' : '{{=request.vars["id"]}}' , 'config' : {{=row.config.id}} }, '{{=filename}}' ) }" >
             {{pass}}
-                {{=db.config[row.config_id].name}} </a>
+                {{=row.config.name}} </a>
         {{pass}}
     </div>