[BUGFIX] PageLayoutView: Honor page permissions in getTable_tt_content() 86/43186/3
authorMorton Jonuschat <m.jonuschat@mojocode.de>
Fri, 11 Sep 2015 08:21:32 +0000 (10:21 +0200)
committerChristian Kuhn <lolli@schwarzbu.ch>
Fri, 11 Sep 2015 09:45:19 +0000 (11:45 +0200)
The call to readPageAccess() expects a SQL fragment to check the page
permissions but the raw integer value for the access rights was passed.
The resulting invalid part of the SQL statement (for example `AND 31`)
is ignored by MySQL but results in the permissions not being checked.

Translate the page permissions to the expected SQL fragment for
readPageAccess().

Resolves: #69660
Releases: master
Change-Id: I51a92948dd754410f128683892a9312d97067ea3
Reviewed-on: http://review.typo3.org/43186
Reviewed-by: Andreas Fernandez <typo3@scripting-base.de>
Tested-by: Andreas Fernandez <typo3@scripting-base.de>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
typo3/sysext/backend/Classes/View/PageLayoutView.php

index 7843439..f0dd7a1 100644 (file)
@@ -395,8 +395,8 @@ class PageLayoutView extends \TYPO3\CMS\Recordlist\RecordList\AbstractDatabaseRe
         * @return string HTML for the listing
         */
        public function getTable_tt_content($id) {
-               $this->pageinfo = BackendUtility::readPageAccess($this->id, $this->ext_CALC_PERMS);
                $backendUser = $this->getBackendUser();
+               $this->pageinfo = BackendUtility::readPageAccess($this->id, $backendUser->getPagePermsClause($this->ext_CALC_PERMS));
                $this->initializeLanguages();
                $this->initializeClipboard();
                $pageTitleParamForAltDoc = '&recTitle=' . rawurlencode(BackendUtility::getRecordTitle('pages', BackendUtility::getRecordWSOL('pages', $id), TRUE));