Information Disclosure in Workspaces Module

@@ -117,7 +117,15 @@ public function getRowDetails(array $stages, \stdClass $parameter): array
     {
         $backendUser = $this->getBackendUser();
         $table = $parameter->table;
-        $schema = $this->tcaSchemaFactory->get($table);
+        $schema = $this->tcaSchemaFactory->has($table) ? $this->tcaSchemaFactory->get($table) : null;
+
+        if ($schema === null
+            || !$schema->isWorkspaceAware()
+            || !$backendUser->check('tables_modify', $table)
+        ) {
+            throw new \RuntimeException(sprintf('Invalid access to table "%s"', $table), 1756882012);
+        }
+
         $diffReturnArray = [];
         $liveReturnArray = [];
         $plainLiveRecord = $liveRecord = (array)BackendUtility::getRecord($table, $parameter->t3ver_oid);
@@ -176,7 +184,12 @@ public function getRowDetails(array $stages, \stdClass $parameter): array
             $configuration = $fieldTypeInformation->getConfiguration();
             // check for exclude fields
             $isFieldExcluded = $fieldTypeInformation->supportsAccessControl();
-            if ($backendUser->isAdmin() || !$isFieldExcluded || GeneralUtility::inList($backendUser->groupData['non_exclude_fields'], $table . ':' . $fieldName)) {
+            if ($backendUser->isAdmin()
+                || (
+                    $fieldTypeInformation->getDisplayConditions() !== 'HIDE_FOR_NON_ADMINS'
+                    && (!$isFieldExcluded || GeneralUtility::inList($backendUser->groupData['non_exclude_fields'], $table . ':' . $fieldName))
+                )
+            ) {
                 $granularity = $fieldTypeInformation->isType(TableColumnType::FLEX) ? DiffGranularity::CHARACTER : DiffGranularity::WORD;
                 // call diff class only if there is a difference
                 if ($fieldTypeInformation->isType(TableColumnType::FILE)) {

@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Workspaces\Tests\Functional\Service;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\Test;
+use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
+use TYPO3\CMS\Core\Localization\LanguageServiceFactory;
+use TYPO3\CMS\Workspaces\Domain\Repository\WorkspaceRepository;
+use TYPO3\CMS\Workspaces\Domain\Repository\WorkspaceStageRepository;
+use TYPO3\CMS\Workspaces\Service\GridDataService;
+use TYPO3\CMS\Workspaces\Service\StagesService;
+use TYPO3\TestingFramework\Core\Functional\FunctionalTestCase;
+
+final class GridDataServiceTest extends FunctionalTestCase
+{
+    protected array $coreExtensionsToLoad = ['workspaces'];
+    private ?BackendUserAuthentication $backendUser = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->importCSVDataSet(__DIR__ . '/../Fixtures/be_users.csv');
+        $this->importCSVDataSet(__DIR__ . '/../Fixtures/sys_workspace.csv');
+
+        $this->backendUser = $this->setUpBackendUser(1);
+        $this->backendUser->workspace = 91;
+        $GLOBALS['LANG'] = $this->get(LanguageServiceFactory::class)->createFromUserPreferences($this->backendUser);
+    }
+
+    public static function getRowDetailsThrowsExceptionDataProvider(): \Generator
+    {
+        $editStage = StagesService::STAGE_EDIT_ID;
+        yield 'non-existing table' => ['table' => 'does-not-exist', 'liveId' => 0, 'versionId' => 0, 'stage' => $editStage];
+        yield 'workspace-unaware table' => ['table' => 'sys_note', 'liveId' => 0, 'versionId' => 0, 'stage' => $editStage];
+    }
+
+    #[Test]
+    #[DataProvider('getRowDetailsThrowsExceptionDataProvider')]
+    public function getRowDetailsThrowsException(string $table, int $liveId, int $versionId, int $stage): void
+    {
+        $workspace = $this->get(WorkspaceRepository::class)->findByUid($this->backendUser->workspace);
+        $stages = $this->get(WorkspaceStageRepository::class)->findAllStagesByWorkspace(
+            $this->backendUser,
+            $workspace
+        );
+
+        $instruction = new \stdClass();
+        $instruction->table = $table;
+        $instruction->t3ver_oid = $liveId;
+        $instruction->uid = $versionId;
+        $instruction->stage = $stage;
+
+        $subject = $this->get(GridDataService::class);
+
+        $this->expectException(\RuntimeException::class);
+        $this->expectExceptionCode(1756882012);
+        $subject->getRowDetails($stages, $instruction);
+    }
+}