Item12491: don't disclose topics a user doesn't have view rights on

git-svn-id: http://svn.foswiki.org/trunk@16706 0b4bb1d4-4e5a-0410-9cc4-b2b747904278
foswiki · May 6, 2013 · 27212f0 · 27212f0
1 parent 8970f98
commit 27212f0
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/core/lib/Foswiki/Macros/TOPICLIST.pm b/core/lib/Foswiki/Macros/TOPICLIST.pm
@@ -31,6 +31,10 @@ sub TOPICLIST {
     my $it = $webObject->eachTopic();
     while ( $it->hasNext() ) {
         my $item = $it->next();
+
+        my $topicObject = Foswiki::Meta->new( $this, $web, $topic );
+        next unless $topicObject->haveAccess("VIEW");
+
         my $line = $format;
         $line =~ s/\$web\b/$web/g;
         $line =~ s/\$topic\b/$item/g;