Steps to reproduce
This is reproducible on our demo instance:
- Change travel-demo-publishers permissions to only allow them to read/write on travel site.
- Create as superuser or any editor a publishing task for sportstation or a subpage of it.
- Login as a travel-demo-publisher and check the tasks.
Expected results
Since the user doesn't have permissions over the published pages, we would expect no task to be visible to him.
Actual results
All tasks are available regardless of the ACLs set for the user.
Workaround
Development notes
|