a

files/models/media.py

@@ -730,15 +730,6 @@ class Media(models.Model):
             ep["updated_time"] = encoding.update_date
         return ep
 
-    @property
-    def categories_info(self):
-        """Property used on serializers"""
-
-        ret = []
-        for cat in self.category.all():
-            ret.append({"title": cat.title, "url": cat.get_absolute_url(), "is_lms_course": cat.is_lms_course})
-        return ret
-
     @property
     def tags_info(self):
         """Property used on serializers"""

files/serializers.py

@@ -98,7 +98,27 @@ class MediaSerializer(serializers.ModelSerializer):
                     self.fields['category'].queryset = non_rbac_categories.union(rbac_categories)
 
 
-class SingleMediaSerializer(serializers.ModelSerializer):
+class CategoriesInfoMixin:
+    categories_info = serializers.SerializerMethodField()
+
+    def get_categories_info(self, obj):
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+
+        if user and user.is_authenticated:
+            accessible_rbac = set(user.get_rbac_categories_as_member().values_list("pk", flat=True))
+        else:
+            accessible_rbac = set()
+
+        ret = []
+        for cat in obj.category.all():
+            if cat.is_rbac_category and cat.pk not in accessible_rbac:
+                continue
+            ret.append({"title": cat.title, "url": cat.get_absolute_url(), "is_lms_course": cat.is_lms_course})
+        return ret
+
+
+class SingleMediaSerializer(CategoriesInfoMixin, serializers.ModelSerializer):
     user = serializers.ReadOnlyField(source="user.username")
     url = serializers.SerializerMethodField()
     is_shared = serializers.SerializerMethodField()
@@ -177,7 +197,7 @@ class SingleMediaSerializer(serializers.ModelSerializer):
         )
 
 
-class MediaSearchSerializer(serializers.ModelSerializer):
+class MediaSearchSerializer(CategoriesInfoMixin, serializers.ModelSerializer):
     url = serializers.SerializerMethodField()
     api_url = serializers.SerializerMethodField()