Detail view does not respect plugin configuration (demand)

[jacobsenj]

Bug Report

Current Behavior
The news detail view of a news will not respect any demand set by the plugin/typoscript configuration and will render any existing news record.

Expected behavior/output
The news detail view should not render any existing news record that will not match the plugin/typoscript configuration and respond with a 404 HTTP code.

Environment

• TYPO3 version(s): 13.4.24
• news version: 14.0.1
• Is your TYPO3 installation set up with Composer (Composer Mode): yes
• OS: OSX 15.7.3, FreeBSD 14.3-RELEASE-p2

Possible Solution
Check if the news is "allowed" to be rendered given the current plugin/typoscript configuration (demand) within the detailAction in NewsController.

Additional context
We have multiple websites within a multisite TYPO3 Setup. Each website has the possibility to share news to other websites via configured categories on a news record. The news listings will filter the news correctly and only display news with given categories (category conjuction = and) i.e. categories "News" and "Webseite 3". However the detail page will show any news on each websites by just switching the domain names in the url (news detail pages are on same paths on each of the websites domains).

[georgringer]

you could use https://github.com/georgringer/news_category_pid_constraint

[jacobsenj]

you could use https://github.com/georgringer/news_category_pid_constraint

looking into it, thx for the hint