Parent Site Permissions are Applying to Child Sites

• Type: Bug
• Status: Resolved
• Resolution: Fixed
• Affects Version/s: 7.0.0 DXP FP89, 7.0.X, 7.1.10 DXP FP16, 7.1.X, 7.2.10 DXP FP3, 7.2.10 DXP FP4, 7.2.X, Master
• Fix Version/s: Master
• Component/s: Application Security > Permissions
• Labels: None
• Flagged:
  Impediment
• Fix Priority: 3
• Sprint: AppSec Iteration 55, AppSec Iteration 56, AppSec Iteration 57
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/98852

On 7.2 FP1 & 7.2 SP1 some of the permissions from a site role that is applied to the user of a parent site are also applying to a child site. 

Site A is a parent of Site B. I'm giving John the Site Administrator role for Site A. When John goes to Site B he doesn't have all the administrator functionalities, but he does have the ability to add pages, for instance.

The documentation says the following "Each child Site in the hierarchy has its own administrator, and the Site Administrator role permissions do not flow down to child Sites in the hierarchy." https://portal.liferay.dev/docs/7-2/user/-/knowledge_base/u/understanding-site-management

Updated description:

Reproduce steps:

1. Login as portal admin, for example, test user.
2. Create a parent site, and child site.
3. Create a user, call it parent.admin, as parent site adminstrator.
4. Go to control panel and verify site administrator role has "Allow subsites management" disabled.
5. Login as parent.admin and go to child site.

Expected: parent.admin cannot do any management action to child site.
Actual: parent.admin can add pages and etc.

6. Login as portal admin.
7. Go to control panel and enable "Allow subsites management" for site adminstrator role.
8. Login as parent.admin and go to child site.

Expected: parent.admin can do any management action to child site.