throw exception if related collection cannot be accessed

Fixes #667

src/core/Directus/Database/Exception/ForbiddenFieldAccessException.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Directus\Database\Exception;
+
+use Directus\Exception\ForbiddenException;
+
+class ForbiddenFieldAccessException extends ForbiddenException
+{
+    const ERROR_CODE = 215;
+
+    public function __construct($field)
+    {
+        $message = sprintf('Unable to access "%s" related data', $field);
+
+        parent::__construct($message);
+    }
+}

src/core/Directus/Database/TableGateway/RelationalTableGateway.php

@@ -14,6 +14,7 @@
 use Directus\Exception\ErrorException;
 use Directus\Exception\UnprocessableEntityException;
 use Directus\Permissions\Exception\ForbiddenCollectionReadException;
+use Directus\Permissions\Exception\ForbiddenFieldReadException;
 use Directus\Permissions\Exception\PermissionException;
 use Directus\Permissions\Exception\UnableFindOwnerItemsException;
 use Directus\Util\ArrayUtils;
@@ -1198,6 +1199,12 @@ protected function parseDotFilters(Builder $mainQuery, array $filters)
             while ($relational) {
                 $nextTable = SchemaService::getRelatedCollectionName($nextTable, $nextColumn);
                 $nextColumn = array_shift($columnList);
+
+                // Confirm the user has permission to all chained (dot) fields
+                if ($this->acl && !$this->acl->canRead($nextTable)) {
+                    throw new Exception\ForbiddenFieldAccessException($nextColumn);
+                }
+
                 $relational = SchemaService::hasRelationship($nextTable, $nextColumn);
                 $columnsTable[] = $nextTable;
             }