divio/django-cms — Issue #1113: View permissions for != 'Current Page' may not work as expected.
Author: kezabelle
Created: 2011-12-09 15:53:36+00:00
State: open

So far, I have tested this with:

* 2.2 release
* 2.2.x from develop
* mptt 0.4.2
* mptt 0.5.1

I have produced a test case in [this branch](https://github.com/kezabelle/django-cms/commits/viewperms) in commits [#2b12de480b56095077ff45770aa9e49f30c79345](https://github.com/kezabelle/django-cms/commit/2b12de480b56095077ff45770aa9e49f30c79345) and [#fd5c9d99ac8664e27bc13b01fa4be408d0d8262f](https://github.com/kezabelle/django-cms/commit/fd5c9d99ac8664e27bc13b01fa4be408d0d8262f) though it now strikes me that the test will probably fail for reasons unrelated (the test case asserts page ancestry, and there are other pages used by the test suite that may affect that).

I have a [standalone demonstration](https://gist.github.com/1451938) of the same code without being a unit test, if you can sacrifice the time to create a database.

The premise is, given the following page structure:

* page 1
* page 2
* page 3
* page 4
* page 5
* page 6

If I assign any view restrictions to __page 6__, then only that and it's children/descendents should get those view restrictions. Instead, __page 4__, the child of a sibling (__page 3__) also gets those view restrictions. This seems borne out for any of the view permissions other than _current page_ (```ACCESS_PAGE```)

The crux of the problem is ```PagePermission.objects.for_page()``` logic seems to allow for other elements in the same root __tree_id__ to affect the display of otherwise unrelated nodes.