User belonging to a group which has a role can't see Workflow instances

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 6.0.11 EE, 6.0.12 EE, 6.1.0 CE RC1
• Fix Version/s: --Sprint 12/11, 6.1.0 CE RC1, 6.0.X EE
• Component/s: Infrastructure, Integrations > Workflow > Kaleo Engine, Legacy > Workflow Portlets
• Labels:
  • QA-R
• Environment: Tomcat 6.0.32 + MySQL 5. 6.0.x Revision 84387. ; Tomcat 6.0.32 + MySQL 5. 6.1.x Revision 84467.
• Branch Version/s:
  6.0.x
• Backported to Branch:
  Committed
• Similar Issues: Show 5 results ; ;

  LPS-5531	Permission check for users which belong to an organization which belon to a community
  LPS-4748	Search finds results in communities you don't belong to
  LPS-34927	Table Header in the Inherited Roles section of a User who belongs to a User Group is not displayed after the User is assigned to a Site.
  LPS-19075	Asset entries should indicates which group they're belong to when Asset Scope is configured to includes global scope
  LPS-19925	Regular Role to group

Step to reproduce :
1/ create a user "userTest"
2/ create a userGroup "userGroupTest"
3/ assign userTest to userGroupTest
4/ apply role "Portal Administrator" to userGroupTest
5/ apply "Single Approver" Workflow to the journalArticle content type
6/ create a journalArticle, and click on "Submit for publication"

All user belonging to userGroupTest won't be able to see and assign the workflow task in the Kaleo page "My Workflow Tasks". Allthough it is possible to see and assign this task in the "Workflow" page from control panel ("Submissions" tab)

So the page "My Workflow Tasks" should also display all workflow tasks belonging to the role which is applied to the userGroup

[frinux]

Problem is localized in KaleoTaskInstanceTokenFinderImpl:

KaleoTaskInstanceTokenFinderImpl.java

protected String getSearchByUserRoles(
		KaleoTaskInstanceTokenQuery kaleoTaskInstanceTokenQuery)
	throws Exception {
[...]
if (searchByUserRoles) {
	List<Long> roleIds = RoleRetrievalUtil.getRoleIds(
		kaleoTaskInstanceTokenQuery.getServiceContext());

	List<UserGroupRole >userGroupRoles =
		UserGroupRoleLocalServiceUtil.getUserGroupRoles(
			kaleoTaskInstanceTokenQuery.getUserId());
[...]

This method does not get the Roles from the userGroup, only the roles from the user (Roles directly assigned to the user, or inderect Roles acquired in groups)

[Sophia Zhang]

Hi Frinux,
Thank you for your report. I was able to reproduce this issue in Liferay Portal 6.0.11EE and our current trunk head 61x-84469. I will update this ticket to reflect this issue.

[Sophia Zhang]

FAILED Manual Testing following steps in description.

Reproduced on:
Tomcat 7.0.21 + MySQL 5. 6.1.x Revision: 84469.
The user couldn't see workflow instance.

Failed on:
Tomcat 6.0.33 + MySQL 5. 6.0.x Revision: 93953.
Tomcat 7.0.22 + MySQL 5. 6.1.x Revision: 93953.
The user still couldn't see workflow instance.

[Sophia Zhang]

Hi Vilmos,
I sent you a email.

Sophia

[Vilmos Papp]

Hi Sophia,

Thanks for the update, I managed to reproduce the problem and will fix it soon.

Vilmos

[Sophia Zhang]

Hi Vimos,
I retested this issue on trunk-94208 and 60x-94208 with same plugin revision. I can view My workflow Tasks now as the user, but I couldn't view My submissions.
According to my understanding, User belonging to the a group which has Admin role should also have same admin role. So if the Joe Bloggs has permission to view pending publications from My Submission in control panel.
So this issue should be partly fixed. I will reopen it, but if you think this is the expected behavior, let me know so I could close this issue.
Thanks,
Sophia

[Sophia Zhang]

I misunderstood what's the expected behavior. Actually it's fixed. User with admin role should not see submissions in My submission cause he was not the assets submitter.
Thanks vimos.

[Sophia Zhang]

Since no more codes committed to 60x, so it's still working on 60x. But I failed build 61x-94251, so I need wait until the build is fixed.

[Sophia Zhang]

PASSED Manual Testing following steps in description.

Reproduced on:
Tomcat 7.0.21 + MySQL 5. 6.1.x Revision: 84469.
The user couldn't see workflow instance

Fixed on:
Tomcat 6.0.33 + MySQL 5. 6.0.x Revision: 94208.
Tomcat 7.0.22 + MySQL 5. 6.1.x Revision: 94208.
The user could see workflow instance now.

[Sophia Zhang]

PASSED Manual Testing following steps in description.

Reproduced on:
Tomcat 7.0.21 + MySQL 5. 6.1.x Revision: 84469.
The user couldn't see workflow instance

Fixed on:
Tomcat 6.0.33 + MySQL 5. 6.0.x Revision: 94208.
Tomcat 7.0.22 + MySQL 5. 6.1.x Revision: 94208.
The user could see workflow instance now.