From ca5d90ba0f7000caff72ab6bd5a3cbc7ef35cd02 Mon Sep 17 00:00:00 2001
From: Marcel Werk <burntime@woltlab.com>
Date: Fri, 15 May 2026 22:49:35 +0200
Subject: [PATCH] Add `canViewCategory` permission for article categories

Closes #6501
---
 com.woltlab.wcf/aclOption.xml                               | 3 +++
 com.woltlab.wcf/userGroupOption.xml                         | 6 ++++++
 wcfsetup/install/files/lib/data/article/Article.class.php   | 6 +++++-
 .../lib/data/article/category/ArticleCategory.class.php     | 4 ++--
 wcfsetup/install/lang/de.xml                                | 2 ++
 wcfsetup/install/lang/en.xml                                | 2 ++
 6 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/com.woltlab.wcf/aclOption.xml b/com.woltlab.wcf/aclOption.xml
index 49c5dfc7150..3b21faa817b 100644
--- a/com.woltlab.wcf/aclOption.xml
+++ b/com.woltlab.wcf/aclOption.xml
@@ -8,6 +8,9 @@
 			<option name="canSetLabel">
 				<objecttype>com.woltlab.wcf.label</objecttype>
 			</option>
+			<option name="canViewCategory">
+				<objecttype>com.woltlab.wcf.article.category</objecttype>
+			</option>
 			<option name="canReadArticle">
 				<objecttype>com.woltlab.wcf.article.category</objecttype>
 			</option>
diff --git a/com.woltlab.wcf/userGroupOption.xml b/com.woltlab.wcf/userGroupOption.xml
index c80de9c48cb..41738d0c8f5 100644
--- a/com.woltlab.wcf/userGroupOption.xml
+++ b/com.woltlab.wcf/userGroupOption.xml
@@ -874,6 +874,12 @@ bmp</defaultvalue>
 				<admindefaultvalue>1</admindefaultvalue>
 				<usersonly>1</usersonly>
 			</option>
+			<option name="user.article.canViewCategory">
+				<categoryname>user.article</categoryname>
+				<optiontype>boolean</optiontype>
+				<defaultvalue>1</defaultvalue>
+				<options>module_article</options>
+			</option>
 			<option name="user.article.canReadArticle">
 				<categoryname>user.article</categoryname>
 				<optiontype>boolean</optiontype>
diff --git a/wcfsetup/install/files/lib/data/article/Article.class.php b/wcfsetup/install/files/lib/data/article/Article.class.php
index 2cdb1f14d40..3611c6ccca1 100644
--- a/wcfsetup/install/files/lib/data/article/Article.class.php
+++ b/wcfsetup/install/files/lib/data/article/Article.class.php
@@ -113,7 +113,11 @@ public function canRead(?UserProfile $user = null): bool
         }
 
         if ($this->getCategory()) {
-            return $this->getCategory()->isAccessible($user->getDecoratedObject());
+            if (!$this->getCategory()->isAccessible($user->getDecoratedObject())) {
+                return false;
+            }
+
+            return (bool)$this->getCategory()->getPermission('canReadArticle', $user->getDecoratedObject());
         }
 
         return $user->getPermission('user.article.canRead');
diff --git a/wcfsetup/install/files/lib/data/article/category/ArticleCategory.class.php b/wcfsetup/install/files/lib/data/article/category/ArticleCategory.class.php
index 861625e100e..339b0fd2047 100644
--- a/wcfsetup/install/files/lib/data/article/category/ArticleCategory.class.php
+++ b/wcfsetup/install/files/lib/data/article/category/ArticleCategory.class.php
@@ -61,7 +61,7 @@ public function isAccessible(?User $user = null)
         }
 
         // check permissions
-        return $this->getPermission('canReadArticle', $user);
+        return $this->getPermission('canViewCategory', $user);
     }
 
     /**
@@ -117,7 +117,7 @@ public function getTitle(): string
      * @param string[] $permissions
      * @return  int[]
      */
-    public static function getAccessibleCategoryIDs(array $permissions = ['canReadArticle'])
+    public static function getAccessibleCategoryIDs(array $permissions = ['canViewCategory'])
     {
         $categoryIDs = [];
         foreach (CategoryHandler::getInstance()->getCategories(self::OBJECT_TYPE_NAME) as $category) {
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 7d40f1a7b6d..511e9a173e9 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -21,6 +21,7 @@
 	<category name="wcf.acl.option">
 		<item name="wcf.acl.option.com.woltlab.wcf.label.canViewLabel"><![CDATA[Kann Labels sehen]]></item>
 		<item name="wcf.acl.option.com.woltlab.wcf.label.canSetLabel"><![CDATA[Kann Labels setzen]]></item>
+		<item name="wcf.acl.option.com.woltlab.wcf.article.category.canViewCategory"><![CDATA[Kann Kategorie betreten]]></item>
 		<item name="wcf.acl.option.com.woltlab.wcf.article.category.canReadArticle"><![CDATA[Kann Artikel lesen]]></item>
 	</category>
 	<category name="wcf.acp.ad">
@@ -917,6 +918,7 @@ Sie erreichen das Fehlerprotokoll unter: {link controller='ExceptionLogView' isE
 		<item name="wcf.acp.group.option.user.article.canAddCommentWithoutModeration"><![CDATA[Kann Kommentare ohne Moderation erstellen]]></item>
 		<item name="wcf.acp.group.option.user.article.canDeleteComment"><![CDATA[Kann eigene Kommentare löschen]]></item>
 		<item name="wcf.acp.group.option.user.article.canEditComment"><![CDATA[Kann eigene Kommentare bearbeiten]]></item>
+		<item name="wcf.acp.group.option.user.article.canViewCategory"><![CDATA[Kann Kategorien betreten]]></item>
 		<item name="wcf.acp.group.option.user.article.canReadArticle"><![CDATA[Kann Artikel lesen]]></item>
 		<item name="wcf.acp.group.option.user.page.canAddComment"><![CDATA[Kann Kommentare erstellen]]></item>
 		<item name="wcf.acp.group.option.user.page.canAddCommentWithoutModeration"><![CDATA[Kann Kommentare ohne Moderation erstellen]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index 3cfd262900b..ab4f4d3a254 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -21,6 +21,7 @@
 	<category name="wcf.acl.option">
 		<item name="wcf.acl.option.com.woltlab.wcf.label.canViewLabel"><![CDATA[Can view labels]]></item>
 		<item name="wcf.acl.option.com.woltlab.wcf.label.canSetLabel"><![CDATA[Can set labels]]></item>
+		<item name="wcf.acl.option.com.woltlab.wcf.article.category.canViewCategory"><![CDATA[Can access the category]]></item>
 		<item name="wcf.acl.option.com.woltlab.wcf.article.category.canReadArticle"><![CDATA[Can read articles]]></item>
 	</category>
 	<category name="wcf.acp.ad">
@@ -893,6 +894,7 @@ You can access the error log at: {link controller='ExceptionLogView' isEmail=tru
 		<item name="wcf.acp.group.option.user.article.canAddCommentWithoutModeration"><![CDATA[Can create comments without approval]]></item>
 		<item name="wcf.acp.group.option.user.article.canDeleteComment"><![CDATA[Can delete their comments]]></item>
 		<item name="wcf.acp.group.option.user.article.canEditComment"><![CDATA[Can edit their comments]]></item>
+		<item name="wcf.acp.group.option.user.article.canViewCategory"><![CDATA[Can access categories]]></item>
 		<item name="wcf.acp.group.option.user.article.canReadArticle"><![CDATA[Can read articles]]></item>
 		<item name="wcf.acp.group.option.user.page.canAddComment"><![CDATA[Can create comments]]></item>
 		<item name="wcf.acp.group.option.user.page.canAddCommentWithoutModeration"><![CDATA[Can create comments without approval]]></item>