Make the shortcut obey the modified permissions of its originating As…

…set. Fixes bug #11549.
plainblack · May 18, 2010 · 9cf2a30 · 9cf2a30
1 parent 7afb41f
commit 9cf2a30
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 5 deletions.
diff --git a/docs/changelog/7.x.x.txt b/docs/changelog/7.x.x.txt
@@ -20,6 +20,7 @@
  - fixed #11572: visitors can enter editProfile
  - fixed #11563: Syndicated Content - descriptionFirstParagraph cuts off
  - fixed #11538: User invite mail: whitespace in message lost
+ - fixed #11549: Shortcut Asset cannot override Page Layout
 
 7.9.4
  - We're shipping underscore.js now for its suite of extremely handy utility

diff --git a/lib/WebGUI/Asset/Shortcut.pm b/lib/WebGUI/Asset/Shortcut.pm
@@ -905,9 +905,13 @@ sub view {
 		}
 	}
 
-	if ($self->get("shortcutToAssetId") eq $self->get("parentId")) {
-		$content = $i18n->get("Displaying this shortcut would cause a feedback loop");
-	} else {
+    if ($self->get("shortcutToAssetId") eq $self->get("parentId")) {
+        $content = $i18n->get("Displaying this shortcut would cause a feedback loop");
+    }
+    elsif (! $shortcut->canView) {
+        $content = '';
+    }
+    else {
         # Make sure the www_view method won't be skipped b/c the asset is cached.
         $shortcut->purgeCache();
 
@@ -1222,10 +1226,12 @@ Render the shortcut in standalone mode.
 =cut
 
 sub www_view {
-        my $self = shift;
-        my $check = $self->checkView;
+        my $self    = shift;
+        my $session = $self->session;
+        my $check   = $self->checkView;
         return $check if defined $check;
         my $shortcut = $self->getShortcut;
+        return $session->privilege->noAccess() unless $shortcut->canView;
         $self->prepareView;
 
         # Make sure the www_view method won't be skipped b/c the asset is cached.