tx_news article in restricted area can be accessed via url

Question

I have tx_news installed with TYPO3 8.7. I use the plugin two times, one in a restricted area and the other one in a public area.

I noticed that if I paste a speaking url path segment of an article in the restricted area into the url of the detail page of the public area, the article will be shown without any restrictions.

Example:
The public url of an article is
https://example.com/news/artikel/my_public_article

If I replace now /my_public_article with the speaking url path segment of the restricted article like
https://example.com/news/artikel/my_restricted_article
the article will be shown.

How can I avoid that?

I already set the starting point of the plugin on my public detail page to the public records folder and set recursive to 0.

Answer 1

You can set the following TypoScript:

plugin.tx_news.settings.detail.checkPidOfNewsRecord = 1

From the news documentation:

If set, the detail view checks the incoming news record against the defined starting point(s). If those don’t match, the news record won’t be displayed.