Prevent named places being accessible by persons without permission for forms with MHL.restrictAccessStrict

[olzraiti]

[olzraiti]

Actually the current implementation is that if the named places query has a collectionID, then it will fetch only places with public: true. All our named places with collectionID are public.

So, we shouldn't implement this form permissions checking if all the places are anyway public.

Closed as wontfix.

FYI @esko-piirainen as we planned on this face to face.

[olzraiti]

Or we could drop the public property and do access control based on collectionID & form permissions... That could simplify things as now there's two ways of access control.

I already implemented the form permissions based access control, stashed to branch named-places-query-check-for-form-permissions-48

[olzraiti]

Example of the problem

curl https://laji.fi/api/named-places/MNP.23962\?includeUnits\=true