Filter search results by ACL

We should not really show search results for private projects to not
authenticated users.

Fixes #468
Signed-off-by: Michal Čihař <michal@cihar.com>

weblate/trans/views/basic.py

@@ -126,6 +126,13 @@ def search(request):
             'translation',
         )
 
+        # Filter results by ACL
+        acl_projects, filtered = Project.objects.get_acl_status(request.user)
+        if filtered:
+            units = units.filter(
+                translation__subproject__project__in=acl_projects
+            )
+
         limit = request.GET.get('limit', 50)
         page = request.GET.get('page', 1)