Make the shortcut obey the modified permissions of its originating Asset. Fixes bug #11549.

docs/changelog/7.x.x.txt

@@ -20,6 +20,7 @@
  - fixed #11572: visitors can enter editProfile
  - fixed #11563: Syndicated Content - descriptionFirstParagraph cuts off
  - fixed #11538: User invite mail: whitespace in message lost
+ - fixed #11549: Shortcut Asset cannot override Page Layout
 
 7.9.4
  - We're shipping underscore.js now for its suite of extremely handy utility

lib/WebGUI/Asset/Shortcut.pm

@@ -905,9 +905,13 @@ sub view {
 		}
 	}
 	
-	if ($self->get("shortcutToAssetId") eq $self->get("parentId")) {
-		$content = $i18n->get("Displaying this shortcut would cause a feedback loop");
-	} else {
+    if ($self->get("shortcutToAssetId") eq $self->get("parentId")) {
+        $content = $i18n->get("Displaying this shortcut would cause a feedback loop");
+    }
+    elsif (! $shortcut->canView) {
+        $content = '';
+    }
+    else {
         # Make sure the www_view method won't be skipped b/c the asset is cached.
         $shortcut->purgeCache();
 
@@ -1222,10 +1226,12 @@ Render the shortcut in standalone mode.
 =cut
 
 sub www_view {
-        my $self = shift;
-        my $check = $self->checkView;
+        my $self    = shift;
+        my $session = $self->session;
+        my $check   = $self->checkView;
         return $check if defined $check;
         my $shortcut = $self->getShortcut;
+        return $session->privilege->noAccess() unless $shortcut->canView;
         $self->prepareView;
 
         # Make sure the www_view method won't be skipped b/c the asset is cached.