EZP-28298: Legacy leaks object names by object link/embed

Fix object name/path leakage for object and node links and embeds
Fix object name leakage for embeds in eZ OE
Fix object name leakage for links/embeds in related objects list

design/admin/templates/content/edit_relations.tpl

@@ -40,7 +40,7 @@
                 </p>
             {else}
                 <p>
-                    {$RelatedImageObjects.item.name|wash} - {"You do not have permission to view this object"|i18n( 'design/admin/content/edit' )}
+                    {"You do not have permission to view this object"|i18n( 'design/admin/content/edit' )}
                 </p>
             {/if}
            <input class="linkbox" type="text" value="&lt;embed href='ezobject://{$RelatedImageObjects.item.id}' /&gt;" readonly="readonly" title="{'Copy this code and paste it into an XML field to embed the object.'|i18n( 'design/admin/content/edit' )}" /><br />
@@ -105,7 +105,7 @@
                         </td>
                     {else}
                         <td class="checkbox">&nbsp;</td>
-                        <td colspan="3">{$RelatedFileObjects.item.name|wash} - {"You do not have permission to view this object"|i18n( 'design/admin/content/edit' )}</td>
+                        <td colspan="3">{"You do not have permission to view this object"|i18n( 'design/admin/content/edit' )}</td>
                         <td class="code">
                             <input class="linkbox" type="text" value="&lt;embed href='ezobject://{$RelatedFileObjects.item.id}' /&gt;" readonly="readonly" title="{'Copy this code and paste it into an XML field to embed the object.'|i18n( 'design/admin/content/edit' )}" /><br />
                             <input class="linkbox" type="text" value="&lt;link href='ezobject://{$RelatedFileObjects.item.id}'&gt;&lt;/link&gt;" readonly="readonly" title="{'Copy this code and paste it into an XML field to link the object.'|i18n( 'design/admin/content/edit' )}" />
@@ -167,7 +167,7 @@
                         </td>
                     {else}
                         <td class="checkbox">&nbsp;</td>
-                        <td colspan="2">{$RelatedObjects.item.name|wash} - {"You do not have permission to view this object"|i18n( 'design/admin/content/edit' )}</td>
+                        <td colspan="2">{"You do not have permission to view this object"|i18n( 'design/admin/content/edit' )}</td>
                         <td class="code">
                             <input class="linkbox" type="text" value="&lt;embed href='ezobject://{$RelatedObjects.item.id}' /&gt;" readonly="readonly" title="{'Copy this code and paste it into an XML field to embed the object.'|i18n( 'design/admin/content/edit' )}" />
                             <input class="linkbox" type="text" value="&lt;link href='ezobject://{$RelatedObjects.item.id}'&gt;&lt;/link&gt;" readonly="readonly" title="{'Copy this code and paste it into an XML field to link the object.'|i18n( 'design/admin/content/edit' )}" />

design/standard/templates/content/datatype/pdf/ezxmltags/embed-inline_denied.tpl

@@ -1,2 +1,2 @@
 {* DO NOT EDIT THIS FILE! Use an override template instead. *}
-{pdf(text, concat( $object.name|wash, " - You do not have permission to view this object"|i18n( 'design/admin/node/view/embed' ) )|wash(pdf) )}
+{pdf(text, "You do not have permission to view this object"|i18n( 'design/admin/node/view/embed' )|wash(pdf) )}

design/standard/templates/content/datatype/pdf/ezxmltags/embed_denied.tpl

@@ -1,2 +1,2 @@
 {* DO NOT EDIT THIS FILE! Use an override template instead. *}
-{pdf(text, concat( $object.name|wash, " - You do not have permission to view this object"|i18n( 'design/admin/node/view/embed' ) )|wash(pdf) )}
+{pdf(text, "You do not have permission to view this object"|i18n( 'design/admin/node/view/embed' )|wash(pdf) )}

design/standard/templates/content/datatype/view/ezxmltags/embed-inline_denied.tpl

@@ -1 +1 @@
-{* DO NOT EDIT THIS FILE! Use an override template instead. *}{$object.name|wash} - {"You do not have permission to view this object"|i18n( 'design/admin/node/view/embed'  )}.
+{* DO NOT EDIT THIS FILE! Use an override template instead. *}{"You do not have permission to view this object"|i18n( 'design/admin/node/view/embed'  )}.

design/standard/templates/content/datatype/view/ezxmltags/embed_denied.tpl

@@ -1,4 +1,4 @@
 {* DO NOT EDIT THIS FILE! Use an override template instead. *}
 <div class="object-{$object_parameters.align}{if ne($classification|trim,'')} {$classification|wash}{/if}"{if is_set($id)} id="{$id}"{/if}>
-{$object.name|wash} - {"You do not have permission to view this object"|i18n( 'design/admin/node/view/embed'  )}.
+{"You do not have permission to view this object"|i18n( 'design/admin/node/view/embed'  )}.
 </div>

kernel/classes/datatypes/ezxmltext/handlers/output/ezxhtmlxmloutput.php

@@ -203,6 +203,13 @@ function initHandlerLink( $element, &$attributes, &$siblingParams, &$parentParam
 
             if ( $node != null )
             {
+                if ( !$node->object()->canRead() )
+                {
+                    eZDebug::writeWarning( "Current user does not have read access to the object of node #$nodeID",
+                        'XML output handler: link' );
+                    return $ret;
+                }
+
                 $view = $element->getAttribute( 'view' );
                 if ( $view )
                     $href = 'content/view/' . $view . '/' . $nodeID;
@@ -220,6 +227,13 @@ function initHandlerLink( $element, &$attributes, &$siblingParams, &$parentParam
             if ( isset( $this->ObjectArray["$objectID"] ) )
             {
                 $object = $this->ObjectArray["$objectID"];
+                if ( !$object->canRead() )
+                {
+                    eZDebug::writeWarning( "Current user does not have read access to the object #$objectID",
+                        'XML output handler: link' );
+                    return $ret;
+                }
+
                 $node = $object->attribute( 'main_node' );
                 if ( $node )
                 {