Can view change ChangeListsPortlet without enabling it

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.3.5 CE GA6, 7.3.10 DXP GA1, Master
• Component/s: Content Publishing > Publications
• Labels:
  • 7.3-should
  • security
• Fix Priority: 3
• Git Pull Request: https://github.com/Preston-Crary/liferay-portal/pull/1152

Can view change ChangeListsPortlet without enabling it.

Steps

1. Sign in as admin
2. Navigate to http://localhost:8080/group/guest/~/control_panel/manage?p_p_id=com_liferay_change_tracking_web_portlet_ChangeListsPortlet

Expected
Admin must first enable change lists in the configuration portlet.
Actual
Enabling only hides the panel link, knowing the p_p_id is enough to access the portlet.