Thesis projects are listed on theme regardless of permissions
It appears that the student-facing theme page does not verify the student can see the thesis projects which it displays under the theme. This leads to titles of projects accessible to some study programmes being shown to students from other programmes, leading to a 403 after clicking on them.
Other things to check:
- Are archived thesis projects also shown to students in the same way?
- Are links to inaccessible themes shown to students when viewing research group pages?