Enforce visibility on article page and in listings

See #2209

diff --git a/wcfsetup/install/files/lib/data/article/AccessibleArticleList.class.php b/wcfsetup/install/files/lib/data/article/AccessibleArticleList.class.php
index 7043ee2448facf9f1e67ae7ac34fd314d1ec2b04..b5664211d542fa84a2fbb39c22770363f1eb651a 100644 (file)
--- a/wcfsetup/install/files/lib/data/article/AccessibleArticleList.class.php
+++ b/wcfsetup/install/files/lib/data/article/AccessibleArticleList.class.php
@@ -1,6 +1,7 @@
 <?php
 namespace wcf\data\article;
 use wcf\data\article\category\ArticleCategory;
+use wcf\system\WCF;
 
 /**
  * Represents a list of accessible articles.
@@ -26,6 +27,10 @@ class AccessibleArticleList extends ViewableArticleList {
                else {
                        $this->getConditionBuilder()->add('article.categoryID IN (?)', [$accessibleCategoryIDs]);
                        $this->getConditionBuilder()->add('article.publicationStatus = ?', [Article::PUBLISHED]);
+                       
+                       if (!WCF::getSession()->getPermission('admin.content.article.canManageArticle')) {
+                               $this->getConditionBuilder()->add('article.isDeleted = ?', [0]);
+                       }
                }
        }
 }

diff --git a/wcfsetup/install/files/lib/data/article/Article.class.php b/wcfsetup/install/files/lib/data/article/Article.class.php
index 2bed2cbbe1a2f6512d664ad753bf3e9c0fda0f4e..a8f6203ab315288a024d2259c462ee99fae084d9 100644 (file)
--- a/wcfsetup/install/files/lib/data/article/Article.class.php
+++ b/wcfsetup/install/files/lib/data/article/Article.class.php
@@ -82,6 +82,10 @@ class Article extends DatabaseObject implements ILinkableObject {
         * @return      boolean
         */
        public function canRead() {
+               if ($this->isDeleted && !WCF::getSession()->getPermission('admin.content.article.canManageArticle')) {
+                       return false;
+               }
+               
                if ($this->publicationStatus != self::PUBLISHED) {
                        if (!WCF::getSession()->getPermission('admin.content.article.canManageArticle') && (!WCF::getSession()->getPermission('admin.content.article.canContributeArticle') || $this->userID != WCF::getUser()->userID)) {
                                return false;