[BUGFIX] Correctly evaluate content edit permissions for users

Users are permitted to edit content of a page, even though
they are not permitted to edit the page itself.

Resolves: #72172
Releases: master
Change-Id: Ie2e60beec5a04632cf1cb7fef32929cab51408c2
Reviewed-on: https://review.typo3.org/45231


Reviewed-by: Georg Ringer <georg.ringer@gmail.com>
Tested-by: Georg Ringer <georg.ringer@gmail.com>
Reviewed-by: Wouter Wolters <typo3@wouterwolters.nl>
Reviewed-by: Johannes Kasberger <johannes.kasberger@reelworx.at>
Tested-by: Johannes Kasberger <johannes.kasberger@reelworx.at>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Markus Klein <markus.klein@typo3.org>

typo3/sysext/backend/Classes/Controller/PageLayoutController.php

@@ -593,7 +593,7 @@ class PageLayoutController
         if ($this->id && $access) {
             // Initialize permission settings:
             $this->CALC_PERMS = $this->getBackendUser()->calcPerms($this->pageinfo);
-            $this->EDIT_CONTENT = $this->pageIsNotLockedForEditors();
+            $this->EDIT_CONTENT = $this->contentIsNotLockedForEditors();
 
             $this->moduleTemplate->getDocHeaderComponent()->setMetaInformation($this->pageinfo);
 
@@ -1354,7 +1354,7 @@ class PageLayoutController
     }
 
     /**
-     * Check the editlock access
+     * Check if page can be edited by current user
      *
      * @return bool
      */
@@ -1363,6 +1363,16 @@ class PageLayoutController
         return $this->getBackendUser()->isAdmin() || ($this->CALC_PERMS & Permission::PAGE_EDIT) === Permission::PAGE_EDIT && !$this->pageinfo['editlock'];
     }
 
+    /**
+     * Check if content can be edited by current user
+     *
+     * @return bool
+     */
+    protected function contentIsNotLockedForEditors()
+    {
+        return $this->getBackendUser()->isAdmin() || ($this->CALC_PERMS & Permission::CONTENT_EDIT) === Permission::CONTENT_EDIT && !$this->pageinfo['editlock'];
+    }
+
     /**
      * Returns LanguageService
      *