[BUGFIX] Respect language permissions for page translations in list

module

If an editor has got access to only a subset of languages, only those
must be visible within the list module for page translations.

Resolves: #90367
Releases: master, 9.5
Change-Id: I6deae42f2428e23d0dfb7656905db7c453119000
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63232
Reviewed-by: Benni Mack <benni@typo3.org>
Reviewed-by: Richard Haeser <richard@maxserv.com>
Tested-by: Benni Mack <benni@typo3.org>
Tested-by: Richard Haeser <richard@maxserv.com>

typo3/sysext/recordlist/Classes/Controller/RecordListController.php

@@ -418,6 +418,7 @@ function editRecords(table,idList,addParams,CBflag) {
             $pageTranslationsDatabaseRecordList->deniedNewTables = ['pages'];
             $pageTranslationsDatabaseRecordList->hideTranslations = '';
             $pageTranslationsDatabaseRecordList->iLimit = $pageTranslationsDatabaseRecordList->itemsLimitPerTable;
+            $pageTranslationsDatabaseRecordList->setLanguagesAllowedForUser($this->siteLanguages);
             $pageTranslationsDatabaseRecordList->showOnlyTranslatedRecords(true);
             $output .= $pageTranslationsDatabaseRecordList->getTable('pages', $this->id);
         }

typo3/sysext/recordlist/Classes/RecordList/DatabaseRecordList.php

@@ -586,6 +586,13 @@ class DatabaseRecordList
      */
     protected $systemLanguagesOnPage;
 
+    /**
+     * All languages that are allowed by the user
+     *
+     * @var array
+     */
+    protected $languagesAllowedForUser = [];
+
     /**
      * Constructor
      */
@@ -901,6 +908,11 @@ public function getTable($table, $id, $rowList = '')
             }
             $hookObject->getDBlistQuery($table, $id, $addWhere, $selFieldList, $this);
         }
+
+        if ($table == 'pages' && $this->showOnlyTranslatedRecords) {
+            $addWhere .= ' AND ' . $GLOBALS['TCA']['pages']['ctrl']['languageField'] . ' IN(' . implode(',', array_keys($this->languagesAllowedForUser)) . ')';
+        }
+
         $additionalConstraints = empty($addWhere) ? [] : [QueryHelper::stripLogicalOperatorPrefix($addWhere)];
         $selFieldList = GeneralUtility::trimExplode(',', $selFieldList, true);
 
@@ -4086,4 +4098,14 @@ protected function getLanguageService()
     {
         return $GLOBALS['LANG'];
     }
+
+    /**
+     * @param array $languagesAllowedForUser
+     * @return DatabaseRecordList
+     */
+    public function setLanguagesAllowedForUser(array $languagesAllowedForUser): DatabaseRecordList
+    {
+        $this->languagesAllowedForUser = $languagesAllowedForUser;
+        return $this;
+    }
 }