To recreate: 1 - Have some opac and staff only news items 2 - On the opac view a single news item 3 - Change the id in the link to the id of the staff item 4 - View the staff news on the opac? not good
Created attachment 85314 [details] [review] Bug 22370: Prevent OPAC users from seeing staff news from URL To test: 1) Have some OPAC and staff only news items 2) On the OPAC view a single news item 3) Change the ID in the URL to the ID of a staff news item 4) Notice you can view the news item without any problems 5) Apply the patch and refresh the page 6) An error should show that the news item doesn't exist 7) Confirm you can still view OPAC news items individually Sponsored-by: Catalyst IT
Created attachment 85797 [details] [review] Bug 22370: Prevent OPAC users from seeing staff news from URL To test: 1) Have some OPAC and staff only news items 2) On the OPAC view a single news item 3) Change the ID in the URL to the ID of a staff news item 4) Notice you can view the news item without any problems 5) Apply the patch and refresh the page 6) An error should show that the news item doesn't exist 7) Confirm you can still view OPAC news items individually Sponsored-by: Catalyst IT Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Created attachment 85804 [details] [review] Bug 22370: Prevent OPAC users from seeing staff news from URL To test: 1) Have some OPAC and staff only news items 2) On the OPAC view a single news item 3) Change the ID in the URL to the ID of a staff news item 4) Notice you can view the news item without any problems 5) Apply the patch and refresh the page 6) An error should show that the news item doesn't exist 7) Confirm you can still view OPAC news items individually Sponsored-by: Catalyst IT Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Awesome work all! Pushed to master for 19.05
Bug against enhancement for 19.05.