Members' Activities lists unviewable content

• Type: Bug
• Status: Verified
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 6.1.1 CE GA2, 6.1.10 EE GA1, 6.2.0 CE M2
• Fix Version/s: None
• Component/s: Social Networking, Social Networking > Activities
• Labels: None
• Environment: Tomcat 7.0 + MySQL 5. 6.1.x GIT ID: 6d6b8814da7c7295ed4cab8420e070793361f856. ; Tomcat 7.0 + MySQL 5. 6.2.x GIT ID: 71ce8e940ae12bae24e2a5e14cf3f836bb291915.
• Fix Priority: 3
• Similar Issues: Show 5 results ; ;

  LPS-18465	Member activities portlet lists private data
  LPS-12761	Can not determine the activities in Members' Activites portlet
  LPS-34363	Social Networking - Viewing Members' Activities with a user whose site membership has been reinstated, throws exceptions
  LPS-22951	Members' Activities and Members portlets are not formatted correctly
  LPS-18780	Members Activity portlet with image activities is broken

Content that should not be displayed in Members' Activities is listed anyway.

How to reproduce :
1. Create 2 (regular) roles : "Big" and "Little"
2. Create one user ("BigUser") with "Big" role and another ("LittleUser") with "Little" role
3. Create a regular Organization named "Org" and add "BigUser" and "LittleUser" as members
4. Create a "Wiki" page in "Org" with "view" permission only for "Big" role
5. Create an "Activities" page in "Org" with "view" permission for "Organization Members" role
6. Add a "wiki" portlet to "Wiki" page and an "Members' Activities" portlet on "Activities"
7. Add a wiki page with default permissions ("Viewable by Organization Members")
===> A new line appears on "Activities"
8. Connect with "LittleUser" and go to "Activities"
9. Click on the link to the new wiki page
===> An error appears : you can't access the wiki page
10. Connect back with your admin user
11. Change permissions to "Wiki" page so that "Little" role can view it
12. Change Organization's Wiki "Main" node permissions so that only "Big" role can view it
13. Connect with "LittleUser" and go to "Activities"
14. Click on the link to the new wiki page
===> An error appears : you can't access the wiki node

Note that I made this exemple for a wiki but it "works" with other contents too (Calendar events, for exemple). I tried on an organization, but a Community can have the problem too.
The problem is here with users' private pages, too.

Regards,
Pierre

[Luyang Tan]

Hi Pierre Morin,
Thanks for the report,I have some questions,first,you use "Members' Activities" portlet on "Activities" page,not "Activities" portlet? "Members' Activities" portlet only display member user's,not administrator's.Second,at beginning you add Wiki page view permission only for "Big" role,so if you sign in with little user,I think of course you couldn't see the wiki page.because little user didn't have that permission,and then at step 12 you change permissions to "Wiki" page so that "Little" role can view it,but at the viki page,you change the permissions so that only "Big" role can view it,I think little user of course couldn't see it.If at the viki page you give the permission that little role also can view it,little user can see the viki page.If I understand anything wrong,please reply me,thanks.I will close this ticket first.

[Pierre Morin]

Hi !

you use "Members' Activities" portlet on "Activities" page,not "Activities" portlet?

==> Yes, I'm talking about "Members' Activities", not just "Activities" portlet

"Members' Activities" portlet only display member user's,not administrator's.

==> I don't understand you on this point.

Second,at beginning you add Wiki page view permission only for "Big" role,so if you sign in with little user,I think of course you couldn't see the wiki page.

==> I agree with you. So why the line about the new page appears for "LittleUser" if it's obvious that he shouldn't see it, because he can't access the page displaying it ?

because little user didn't have that permission,and then at step 12 you change permissions to "Wiki" page so that "Little" role can view it,but at the viki page,you change the permissions so that only "Big" role can view it,I think little user of course couldn't see it.

==> Again, I agree with you. But there's still a line about it in "Members' Activites" portlet.

I wasn't clear enougth I think : by my steps I wanted to let yo see that there is some lines in "Members' Activities" that shouldn't be displayed.

Regards,
Pierre

[Luyang Tan]

Hi Pierre Morin,
First,if you only use "Members' Activities" portlet,you sign in as administrator user,not sign in as a normal user,your action couldn't display on "Members' Activities" portlet,only display on "Activities" portlet.Because "Members' Activities" portlet display only normal user's action.I think you mean at step 9,you said click on the link,An error appears : you can't access the wiki page,but at step 4 you give the "view" permission only for "Big" role,so I think the little user shouldn't see a new line appears on "Activities".Right?

[Pierre Morin]

Hi !

if you only use "Members' Activities" portlet,you sign in as administrator user,not sign in as a normal user,your action couldn't display on "Members' Activities" portlet,only display on "Activities" portlet. Because "Members' Activities" portlet display only normal user's action.

==> I don't understand : if my administrator user is a member of "Org", his actions should be seen in "Members' Activities" in my opinion. And I don't understand what is a "normal" user. But that's not the point.

I think you mean at step 9,you said click on the link,An error appears : you can't access the wiki page,but at step 4 you give the "view" permission only for "Big" role,so I think the little user shouldn't see a new line appears on "Activities".Right?

==> That's the point I'm talking about ! "LittleUser" can't display the wiki page, even if he have the rights to view the content of the wiki page. To my mind, if you can't display the wiki page, you shouldn't see the notifications about it, even if you have access to its content.

In my opinion, while being displaying, "Members' Activities" portlet should check every item it want's to display to see if it can be correctly displayed by the user, before displaying it.

Regards,
Pierre

[Luyang Tan]

Hi Pierre Morin,
I can reproduce this issue in 6.0.6 GA,I can also reproduce it on our current trunk.I will update this ticket to reflect this issue.

[Michael Han]

Please retest against latest 6.1

[Luyang Tan]

FAILED through Manual Testing following the steps in the description.
Tomcat 7.0 + MySQL 5. 6.1.x GIT ID: 6d6b8814da7c7295ed4cab8420e070793361f856.
Tomcat 7.0 + MySQL 5. 6.2.x GIT ID: 71ce8e940ae12bae24e2a5e14cf3f836bb291915.

There are totally two bugs on this ticket. Step 9 and step 14, both the two steps
shouldn't see some lines in "Members' Activities" portlet. In step 14, this bug is
fixed, I can not see the lines anymore, but in step 9, I can still see the lines.

[Drew Blessing]

This is a bit of a security concern. Once Social Office comes out this may be an even bigger concern because users will ideally utilize the personal site more and the activities feed is a part of the public profile. Everytime a user creates a private task or uploads a private file, those things are published to the feed.

Thanks for looking into this.

[Luyang Tan]

FAILED Manual Testing following the steps in the description.

Failed on:
Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: 285cf2578d185a0fd2ff4a3ee512a4fe7ec8fd90.
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: a7e8d79e0d8a8cfaa2172ad0bf443931c9b64da3.

In step 9, I shouldn't see some lines in "Members' Activities" portlet. But now I can see,
that's not right. Other place works fine.