From 8b8dc99431d07100f94f44e668fc6b866b679b74 Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Mon, 9 Mar 2026 20:29:59 +0900
Subject: [PATCH] Replace $oDocument with empty DocumentItem if access is not
 allowed

---
 modules/board/board.api.php  | 35 +++++++++++++++++++++++++----------
 modules/board/board.view.php |  2 ++
 2 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/modules/board/board.api.php b/modules/board/board.api.php
index 6ca21a452..96519ef89 100644
--- a/modules/board/board.api.php
+++ b/modules/board/board.api.php
@@ -56,12 +56,19 @@ class BoardAPI extends Board
 	public function dispBoardContentView($oModule)
 	{
 		$oDocument = Context::get('oDocument');
-		if($oDocument->isGranted())
+		if ($oDocument->isExists() && $oDocument->isAccessible())
 		{
-			$extra_vars = $oDocument->getExtraVars() ?: [];
-			$oDocument->add('extra_vars', $this->_arrangeExtraVars($extra_vars));
+			if ($oDocument->isGranted())
+			{
+				$extra_vars = $oDocument->getExtraVars() ?: [];
+				$oDocument->add('extra_vars', $this->_arrangeExtraVars($extra_vars));
+			}
+			$oModule->add('oDocument', $this->_arrangeContent($oDocument, $oModule->grant));
+		}
+		else
+		{
+			$oModule->add('oDocument', null);
 		}
-		$oModule->add('oDocument', $this->_arrangeContent($oDocument, $oModule->grant));
 	}
 
 	/**
@@ -70,13 +77,13 @@ class BoardAPI extends Board
 	public function dispBoardContentFileList($oModule)
 	{
 		$oDocument = Context::get('oDocument');
-		if($oDocument->isAccessible())
+		if ($oDocument->isExists() && $oDocument->isAccessible())
 		{
 			$oModule->add('file_list', $this->_arrangeFiles(Context::get('file_list') ?: []));
 		}
 		else
 		{
-			$oModule->add('file_list', array());
+			$oModule->add('file_list', []);
 		}
 	}
 
@@ -93,12 +100,20 @@ class BoardAPI extends Board
 	 **/
 	public function dispBoardContentCommentList($oModule)
 	{
-		$comment_list = Context::get('comment_list');
-		if (!is_array($comment_list))
+		$oDocument = Context::get('oDocument');
+		if ($oDocument->isExists() && $oDocument->isAccessible())
 		{
-			$comment_list = [];
+			$comment_list = Context::get('comment_list');
+			if (!is_array($comment_list))
+			{
+				$comment_list = [];
+			}
+			$oModule->add('comment_list', $this->_arrangeComments($comment_list));
+		}
+		else
+		{
+			$oModule->add('comment_list', []);
 		}
-		$oModule->add('comment_list', $this->_arrangeComments($comment_list));
 	}
 
 	/**
diff --git a/modules/board/board.view.php b/modules/board/board.view.php
index a24350ef5..f5cc7e84a 100644
--- a/modules/board/board.view.php
+++ b/modules/board/board.view.php
@@ -318,6 +318,7 @@ class BoardView extends Board
 				{
 					if (abs($oDocument->get('member_srl')) != $this->user->member_srl)
 					{
+						$oDocument = DocumentModel::getDocument(0);
 						Context::set('document_srl', null, true);
 						$this->dispBoardMessage('msg_not_founded', 404);
 					}
@@ -326,6 +327,7 @@ class BoardView extends Board
 				// if the document is TEMP saved, pretend that it doesn't exist.
 				if($oDocument->getStatus() == 'TEMP')
 				{
+					$oDocument = DocumentModel::getDocument(0);
 					Context::set('document_srl', null, true);
 					$this->dispBoardMessage('msg_not_founded', 404);
 				}