Ok, in 2.4 sp1 pages are checked for security before being displayed as a tab in the navigation in
boss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the siblingURLs (your term in the JSP page).
Can this be fixed so that the psib parameter only gives you a handle to a map that gives you objects you have permissions to see?
Thanks
Stephen
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4011433#4011433
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4011433