Index: openacs-4/packages/xowiki/www/admin/set-publish-state.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/www/admin/set-publish-state.tcl,v
diff -u -r1.16 -r1.16.2.1
--- openacs-4/packages/xowiki/www/admin/set-publish-state.tcl	27 Jan 2019 17:07:55 -0000	1.16
+++ openacs-4/packages/xowiki/www/admin/set-publish-state.tcl	11 Mar 2022 16:57:20 -0000	1.16.2.1
@@ -14,6 +14,12 @@
 }
 
 set page [::xo::db::CrClass get_instance_from_db -revision_id $revision_id]
+# ensure page is from the current package
+if {$package_id != [$page package_id]} {
+  ad_return_forbidden
+  ad_script_abort
+}
+
 $page update_publish_status $state
 
 ad_returnredirect $return_url