[BUGFIX] Template module must respect workspaces

The template module now respects the workspace constraint of the current
backend user and the stored sys_template records.

Resolves: #86131
Releases: master, 8.7
Change-Id: I0463844c4222957aede4b4ca749a3368cb399f81
Reviewed-on: https://review.typo3.org/58171
Tested-by: TYPO3com <no-reply@typo3.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

typo3/sysext/core/Classes/TypoScript/ExtendedTemplateService.php

@@ -19,6 +19,7 @@
 use TYPO3\CMS\Core\Context\Context;
 use TYPO3\CMS\Core\Database\ConnectionPool;
 use TYPO3\CMS\Core\Database\Query\QueryBuilder;
+use TYPO3\CMS\Core\Database\Query\Restriction\BackendWorkspaceRestriction;
 use TYPO3\CMS\Core\Database\Query\Restriction\DeletedRestriction;
 use TYPO3\CMS\Core\Exception;
 use TYPO3\CMS\Core\Imaging\Icon;
@@ -892,7 +893,9 @@ protected function getTemplateQueryBuilder(int $pid): QueryBuilder
             ->getQueryBuilderForTable('sys_template');
         $queryBuilder->getRestrictions()
             ->removeAll()
-            ->add(GeneralUtility::makeInstance(DeletedRestriction::class));
+            ->add(GeneralUtility::makeInstance(DeletedRestriction::class))
+            ->add(GeneralUtility::makeInstance(BackendWorkspaceRestriction::class));
+
         $queryBuilder->select('*')
             ->from('sys_template')
             ->where(