2

Resolved

View permissions not enforced when a routable item has ContainerPart

description

ContainerPart handler overrides item display route and directs it to ItemController in Containers. That controller (as opposed to ItemController in Contents) does not check view permissions at all.

Besides the permission check the rest of the code is identical (the BuildDisplay call) - it looks like some old leftover that messes things up.

comments

Piedone wrote Nov 13, 2012 at 11:12 AM

pszmyd wrote Jun 21, 2013 at 9:37 PM

Fixed in changeset de53605cbdff

sfmskywalker wrote Mar 28 at 1:28 AM

Fixed in changeset 5e6fe8e253fea08f9271bbce27a5c2c0d8c56752