Description
org.apache.jetspeed.om.page.psml.FragmentImpl.getFragments() can return null if all fragments fail the security check: see line 560.
However, ContentFragmentImpl assumes that a non-null value is returned: for instance in ContentFragmentList.duplicateList().
I assume the best fix is to always return a list, even if empty.
I will supply a patch in the next day or two.