User with no view rights on a page can see a PDF in another page even if the "asauthor" value is set to 0 or false when using an absolut/explicit URL

[ane-gabriela]

Steps to reproduce:

1. As Admin edit a page
2. Click on Insert > Other macros
3. Search and select PDF Viewer
4. Click on "Upload a file..." > Upload a PDF file
5. Click on Submit
6. Click on Save & View
7. Access More Actions > Administer Page > Users & Rights > Rights: Page > Users
8. Deny View right for a simple user
9. Access the page with the simple user
10. Create a new page as Admin
11. Click on Insert > Other macros
12. Search and select PDF Viewer
13. Under File add the URL of the attachment from the other page ex. "http://localhost:8080/xwiki/bin/download/PDF%20Viewer/WebHome/Testing%4027.06.2017.pdf?rev=1.1"
14. Select and Submit then Save & View
15. Access the page with the simple user

Expected results: The simple user that doesn't have view rights on the initial page where the attachment is located, can't view the PDF in the second page either if the "asauthor" value is false or 0, which is the default.

As per https://store.xwiki.com/xwiki/bin/view/Extension/PDFViewerMacro#documentation if "asauthor" is true (or 1 or yes) and the viewing user has no access to the document containing the PDF file, the PDF file could still be viewed on behalf of your view right (as long as you have view right on the containing document). This parameter is helpful when you want to add to a page B a macro pointing to the PDF from another page A, that is protected for some users. Note that the view right is delegated only if the last person that saved page B had indeed view rights on page A. Also, this will not alter the view right on page A.

Actual results: The user with no view rights can't see the initial page and attachment but can see the PDF in the second page. NOTE: Even if the simple user makes changes to the second page, so he will be the last user that saved page B without view rights on page A, he can still see the PDF with the PDF viewer in page B.

NOTE: If the Admin adds the PDF viewer in page B with the File and Document completed separately and "Delegate my view right" to false (and he is the last editor)

Then the user02 doesn't have access on the page B PDF anymore

So with this selections the functionality works.

Environment: Windows 11, XWiki 14.10.10 with MySQL 8.0, Chrome 114, PDF Viewer Macro (Pro) 2.5