Fix: Bad output of extrafields when list is used.
Sec: Missing permission tests