View permissions not enforced when a routable item has ContainerPart


ContainerPart handler overrides item display route and directs it to ItemController in Containers. That controller (as opposed to ItemController in Contents) does not check view permissions at all.

Besides the permission check the rest of the code is identical (the BuildDisplay call) - it looks like some old leftover that messes things up.


Piedone wrote Nov 13, 2012 at 10:12 AM

pszmyd wrote Jun 21, 2013 at 8:37 PM

Fixed in changeset de53605cbdff

sfmskywalker wrote Mar 28, 2014 at 12:28 AM

Fixed in changeset 5e6fe8e253fea08f9271bbce27a5c2c0d8c56752