Vulnerability in EPiServer.Forms
We are playing around with the Foundation MVC project and trying to create a sub menu navigation system using Layoutsettings.
Our sub menu navigation system has the following nested ContentArea blocks:
ContentArea1 -> ContentArea2 -> ContentArea3
On ContentArea3 the section "Visible to" that is used to change the visiblity does not have the "Manage" option.
Why doesn't ContentArea3 have that option?
I'd start by taking a look at where you're creating your block. If you're creating your block in "for this page" or "for this block", it will have the same permissions as its parent.. If you need to control which users / groups can manage the block via the CMS, you'll need to ensure the block is in a standard folder rather than the special "for this ..." folder. If you just want to change the visibility of a particular block in a content area for certain site visitors, I'd suggest using visitor groups to do that.