Hidden Forum topics are public if you know the URL

[Martijn Luinstra]

Hidden Forum topics are public if you know the URL. This should not be the case, preferably.

To reproduce, open https://www.svcover.nl/forum.php?thread=677&page=59 in a private window.

[Jelmer van der Linde]

Hahaha, and I just learned that there is indeed no ACL or whatever for that forum, it is just hard coded in the view that that forum (lucky number 7) should not be displayed to anyone not logged in.

[Jelmer van der Linde]

Also, probeer niet admin=1 in de url te zetten, grote kans dat je toegang krijgt tot de meest vreemde dingen.

[Jelmer van der Linde]

Fixed in the feature/twig branch. Will close this issue once that branch is merged into master.