fixes #2008 - Collections doesn't respect UserPolicy

MediaBrowser.Controller/Entities/Folder.cs

@@ -13,6 +13,7 @@ using System.Threading.Tasks;
 using MediaBrowser.Common.IO;
 using MediaBrowser.Controller.Channels;
 using MediaBrowser.Controller.Entities.Audio;
+using MediaBrowser.Controller.Entities.Movies;
 using MediaBrowser.Controller.Entities.TV;
 using MediaBrowser.Controller.IO;
 using MediaBrowser.Model.Channels;
@@ -735,9 +736,61 @@ namespace MediaBrowser.Controller.Entities
                 query.ParentId = query.ParentId ?? Id;
             }
 
+            if (RequiresPostFiltering2(query))
+            {
+                return QueryWithPostFiltering2(query);
+            }
+
             return LibraryManager.GetItemsResult(query);
         }
 
+        private QueryResult<BaseItem> QueryWithPostFiltering2(InternalItemsQuery query)
+        {
+            var startIndex = query.StartIndex;
+            var limit = query.Limit;
+
+            query.StartIndex = null;
+            query.Limit = null;
+
+            var itemsList = LibraryManager.GetItemList(query);
+            var user = query.User;
+
+            if (user != null)
+            {
+                // needed for boxsets
+                itemsList = itemsList.Where(i => i.IsVisibleStandalone(query.User));
+            }
+
+            var itemsArray = itemsList.ToArray();
+            var totalCount = itemsArray.Length;
+
+            if (limit.HasValue)
+            {
+                itemsArray = itemsArray.Skip(startIndex ?? 0).Take(limit.Value).ToArray();
+            }
+            else if (startIndex.HasValue)
+            {
+                itemsArray = itemsArray.Skip(startIndex.Value).ToArray();
+            }
+
+            return new QueryResult<BaseItem>
+            {
+                TotalRecordCount = totalCount,
+                Items = itemsArray
+            };
+        }
+
+        private bool RequiresPostFiltering2(InternalItemsQuery query)
+        {
+            if (query.IncludeItemTypes.Length == 1 && string.Equals(query.IncludeItemTypes[0], typeof(BoxSet).Name, StringComparison.OrdinalIgnoreCase))
+            {
+                Logger.Debug("Query requires post-filtering due to BoxSet query");
+                return true;
+            }
+
+            return false;
+        }
+
         private bool RequiresPostFiltering(InternalItemsQuery query)
         {
             if (LinkedChildren.Count > 0)