Make sure that viewing permissions are obeyed in the method, and that the DataForm just doesn't hide the link. Fixes bug #12353.

docs/changelog/7.x.x.txt

@@ -13,6 +13,7 @@
  - fixed: encryptLogin and sslEnabled both need to be true
  - fixed: Cache's setByHTTP method returns content, even when it gets an error in the request.  This gives the SC asset fits.
  - fixed #12349: Friends invitation error
+ - fixed #12353: Dataform List mode
 
 7.10.24
  - fixed #12318: asset error causes asset manager to fail

lib/WebGUI/Asset/Wobject/DataForm.pm

@@ -1280,6 +1280,8 @@ Renders the list view of the DataForm.
 
 sub viewList {
     my $self    = shift;
+    return $self->session->privilege->insufficient
+        unless $self->session->user->isInGroup($self->get("groupToViewEntries"));
     my $var     = $self->getTemplateVars;
     return $self->processTemplate($self->getListTemplateVars($var), undef, $self->{_viewListTemplate});
 }