divio/django-cms — Issue #1073: When using view restriction permissions, menu shows restricted pages
Author: bedingue
Created: 2011-10-27 20:48:27+00:00
State: open

The doc for CMS_PUBLIC_FOR says : Decides if pages without any view restrictions are public by default, or staff only.

It seems that there's a scenario where a page has view permission and CMS_PUBLIC_FOR == 'all' that isn't covered by the menu logic.

For example, if I have a page that has a view permission, and a user that doesn't have a permission for this page, it will still show in that user's menu.

I got the CMS menu to be show what I think it should show,
by changing the following line : https://github.com/ojii/django-cms/blob/develop/cms/menu.py#L79

elif settings.CMS_PUBLIC_FOR == 'all':

To :

elif settings.CMS_PUBLIC_FOR == 'all' and not is_restricted: