Vulnerability in EPiServer.Forms
It seems that the current language brunch doesn't affect the IContentLoader.GetAncestors(contentLink) ? The method returns ancestors for the page from the master brunch.
Eg. Current language is “sv”. Master language is “no”. All ancestors exist and are published for “sv” and for “no” language version under the Start page.
var currentContent = contentLoader.Get<PageData>(contentLink, new LanguageSelector(language)); // the current language is "sv", all ancestors pages exist in "sv"
return contentLoader.GetAncestors(contentLink) // the returned pages are from "no" language brunches, but the "sv" version exist too .OfType<PageData>() .Where(p => p.VisibleInMenu) .SkipWhile(x => x.ParentLink == null || !x.ParentLink.CompareToIgnoreWorkID(ContentReference.StartPage)) .FirstOrDefault();
Is it correct behavior?
The design idea is that GetAncestors always should return the ancestors regardless of if an ancestors exist in a language or not (otherwise the result would be somewhat hard to interpret, say e.g. it would returns two item would that mean there are only two items or does it mean only the two closest ancestors exist in the specified language?).
It could have taken an ILanguageSelector as parameter, but if someone called it with a language selector without fallback to master it would be same behaviour as above.
A reasonable thing would be to have a string parameter 'languageä and then create a language selector of that language with fallback to master. But that would give a method on IContentLoader that handles language as string while the other ones have ILanguageSelector which makes the interface inconsistent.