Users can list pages they can't view if they contain a link to a page they can

Reproduction steps:

• Login as Admin
• Create a page PageTest
• Create a page SecretPage with a link (or an attachment on 14.2RC1+) to PageTest.
• Make SecretPage non viewable by User1
• Login as User1
• Visit PageTest. The backlinks section of the information pane is empty
• Edit PageTest and add {{velocity$doc.backlinks{
  Unknown macro: {/velocity}

  }}}

Expected result:
And empty array [] is displayed.

Actual Result:
An array containing the document reference of SecretPage is displayed.