Another users Homebox can be accessed and modified through their Homebox user tab, without having the View / Personalize any Homebox permission

Thanks @Grevil!

I guess this is mitigated by the fact, that changing that homebox will presumably not really change the other users homebox, but the current users homebox I guess. But whatever is the case here, we should fix it entirely.

Can we have simple tests for the permissions? At least checking response codes?

This ended up being caused by a recent fix changing controller parameters to not align with their respective routing parameters and is fixed through 🐛 Non-admin users get "AccessDeniedHttpException: The 'administer user_dashboard presets' permission is required" when trying to add the first a portlet Needs work .