Hi Diego,
You are right this is a bug, the Thread.aspx page is only enforcing page view permissions not module view permissions. To fix it I will change this code:
if (!UserCanViewPage())
{
if (!Request.IsAuthenticated)
{
SiteUtils.RedirectToLoginPage();
}
else
{
SiteUtils.RedirectToAccessDeniedPage();
}
return;
}
to this:
if (!UserCanViewPage(moduleId))
{
if (!Request.IsAuthenticated)
{
SiteUtils.RedirectToLoginPage();
}
else
{
SiteUtils.RedirectToAccessDeniedPage();
}
return;
}
passing in the moduleid validates the module permissions in addition to the page view permissions.
Thanks,
Joe