diff --git a/core/control/ContentController.php b/core/control/ContentController.php index 832c94e37..c47f781c6 100755 --- a/core/control/ContentController.php +++ b/core/control/ContentController.php @@ -109,11 +109,9 @@ class ContentController extends Controller { if($this->dataRecord && $this->URLSegment != 'Security' && !$this->dataRecord->can('View')) { return Security::permissionFailure($this); } -var_dump(Versioned::current_stage()); + // Draft/Archive security check - only CMS users should be able to look at stage/archived content if($this->URLSegment != 'Security' && !Session::get('unsecuredDraftSite') && (Versioned::current_archived_date() || (Versioned::current_stage() && Versioned::current_stage() != 'Live'))) { - var_dump($this->URLSegment); - var_dump($this->dataRecord->canViewStage(Versioned::current_stage())); if(!$this->dataRecord->canViewStage(Versioned::current_stage())) { $link = $this->Link(); $message = _t("ContentController.DRAFT_SITE_ACCESS_RESTRICTION", 'You must log in with your CMS password in order to view the draft or archived content. Click here to go back to the published site.'); diff --git a/tests/control/ContentControllerTest.yml b/tests/control/ContentControllerTest.yml index 9166efa61..d0a102a31 100755 --- a/tests/control/ContentControllerTest.yml +++ b/tests/control/ContentControllerTest.yml @@ -1,3 +1,27 @@ +Group: + editors: + Title: Editors + admins: + Title: Administrators + +Permission: + admins: + Code: VIEW_DRAFT_CONTENT + Group: =>Group.admins + editors: + Group: =>Group.editors + +Member: + editor: + FirstName: Test + Surname: Editor + Groups: =>Group.editors + admin: + FirstName: Test + Surname: Administrator + Groups: =>Group.admins + + ContentControllerTest_Page: root_page: Title: Home Page @@ -13,4 +37,10 @@ ContentControllerTest_Page: third_level_page_2: Title: Third Level Page Two URLSegment: third-level-2 - Parent: =>ContentControllerTest_Page.second_level_page \ No newline at end of file + Parent: =>ContentControllerTest_Page.second_level_page + contact_page: + Title: Contact Page + URLSegment: contact + CanViewType: OnlyTheseUsers + EditorGroups: =>Group.admins + \ No newline at end of file