Site member can view message boards thread even when view permissions are disabled

• Type: Bug
• Status: Closed
• Resolution: Won't Fix
• Affects Version/s: Master
• Fix Version/s: Master
• Component/s: Message Boards
• Labels: None
• Fix Priority: 3

Steps to reproduce:

1. Add a message boards widget to a site
2. Add a message boards post
3. Disable permissions for site members to view the post
4. Add a new user (no roles) to the site
5. Log in as new user
6. Navigate to message boards widget

Expected result:
Since the VIEW permission is disabled for site members, the user does not see the message boards post.

Actual result:
The message boards post displays.

After disabling guest VIEW permissions, the site member is unable to see the post.

Reproduced on:
Tomcat 9.0.33 + HSQL 2.3.
Portal master-private 12dd798021f91789edea2c2b81352434579c8991

7.0.x-private c28a80b43da89c965130ce2472606da0536fe2b8