diff --git a/typo3/sysext/backend/Classes/Security/CategoryPermissionsAspect.php b/typo3/sysext/backend/Classes/Security/CategoryPermissionsAspect.php index e385d0841247b068c5d0babd5440971ab683651c..bdef965731c6df096dddd8715145c793cc82dcc4 100644 --- a/typo3/sysext/backend/Classes/Security/CategoryPermissionsAspect.php +++ b/typo3/sysext/backend/Classes/Security/CategoryPermissionsAspect.php @@ -65,6 +65,15 @@ class CategoryPermissionsAspect if (!empty($categoryMountPoints) && !empty($treeNodeCollection)) { + // Check the rootline against categoryMountPoints when tree was filtered + if ($dataProvider->getRootUid() !== null) { + $uidsInRootline = $this->findUidsInRootline($dataProvider->getRootUid()); + if (!empty(array_intersect($categoryMountPoints, $uidsInRootline))) { + // One of the parents was found in categoryMountPoints so all children are secure + return; + } + } + // First, remove all child nodes which must be analysed to be considered as "secure". // The nodes were backed up in variable $treeNodeCollection beforehand. $treeData->removeChildNodes(); @@ -118,4 +127,20 @@ class CategoryPermissionsAspect } return $result; } + + /** + * Find parent uids in rootline + * + * @param integer $uid + * @return array + */ + protected function findUidsInRootline($uid) { + $row = $GLOBALS['TYPO3_DB']->exec_SELECTgetSingleRow('parent', $this->categoryTableName, 'uid=' . (int)$uid); + $parentUids = []; + if ($row['parent'] > 0) { + $parentUids = $this->findUidsInRootline($row['parent']); + $parentUids[] = $row['parent']; + } + return $parentUids; + } }