TYPO3 Core

A user may have restricted access to the backend edit forms via the »explicit deny« in the BE user group configuration. If you set up a group and restrict its access to page content type »plugin« and also restrict the available plugins, a user can only edit and create new content elements of the type plugin. If the user creates a new content element of type plugin, he may only select the allowed plugin types (as defined in the explicit deny for »Pagecontent: Plugin«.

If the user tries to edit an existing content element of type plugin which is not in the list of allowed plugins the plugin select box shows [ INVALID VALUE ("plugin") ] as selected value plus the allowed plugin types. Anyway the user may change any value in the edit form (headline, flexform configuration, ...) and save the changes.

I have verified this for version 4.0.0 - 4.1RC1.
(issue imported from #M5007)