Search returns results which a user does not have permission to access

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.2 EE SP1 (5.2.5)
• Fix Version/s: 5.2 EE SP2 (5.2.6)
• Component/s: Application Security > Permissions, Web Search
• Labels:
  • 5.2_release_notes
• Environment: All

Search returns results which a user does not have permission to access.

If a resource is available to only users who have the a particular community/organization role, "X", it does not take into account that the "X" role is distinct for each community/organization.

For example, if there is a blog entry in the community "Secret Service" which is only viewable to the community role "Community Member" and "Public Joe" who is not a member of "Secret Service" but has "Community Member" role for the community "Public Library". Search will find results for "Public Joe" in both "Community Library" and "Secret Service." Therefore, he can see the blog entry in "Secret Service" as part of the results when he chooses to search the entire portal.

Attempting to access the result will properly cause a permission error. However, users are able to read the title and pieces of the result as part of the search result.