[BUGFIX] Hide edit link for records the user has no edit permissions for 32/61832/2
authorChristian Eßl <indy.essl@gmail.com>
Wed, 25 Sep 2019 17:18:47 +0000 (19:18 +0200)
committerDaniel Goerz <daniel.goerz@posteo.de>
Wed, 9 Oct 2019 08:15:45 +0000 (10:15 +0200)
tt_content records that were translated in "free mode" are still visible
to users in the list view, even if they don't have editing permissions
for the language, but should remain non-editable. The edit button in the
control button is correctly removed in this scenario, however the link
on the record title itself was still visible. When clicking this edit
link, the backend editor would see the error "ERROR: Language was not
allowed." This is now solved by removing this link if the editor has no
access to the record.

Resolves: #89261
Releases: master, 9.5, 8.7
Change-Id: I5b2ba9590a56d9120af43a823fb717960c751931
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/61832
Tested-by: TYPO3com <noreply@typo3.com>
Tested-by: Julian Geils <j_geils@web.de>
Tested-by: Daniel Goerz <daniel.goerz@posteo.de>
Reviewed-by: Michael Semle <michael.semle@b13.com>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Reviewed-by: Julian Geils <j_geils@web.de>
Reviewed-by: Felix P. <f.pachowsky@neusta.de>
Reviewed-by: Daniel Goerz <daniel.goerz@posteo.de>

index 9d0c02e..ec2c24d 100644 (file)
@@ -3449,7 +3449,8 @@ class DatabaseRecordList
                     $permsEdit = $localCalcPerms & Permission::PAGE_EDIT;
                 } else {
-                    $permsEdit = $this->calcPerms & Permission::CONTENT_EDIT;
+                    $backendUser = $this->getBackendUserAuthentication();
+                    $permsEdit = $this->calcPerms & Permission::CONTENT_EDIT && $backendUser->recordEditAccessInternals($table, $row);
                 // "Edit" link: ( Only if permissions to edit the page-record of the content of the parent page ($this->id)
                 if ($permsEdit) {