Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-121642

When VIEW permission on an invited calendar is revoked, other users involved can't load the event

    Details

      Description

      Description: 
      When an user doesn't have VIEW permission on the invited calendar, a PortletException is thrown.
      So the event modal, stop to work and the user can't load correctly the event's info.t.
       
      Steps to reproduce:

      1. Create 2 users "User A" and "User B";
      2. "User A" create a calendar named "SHARED"  in his calendars, now "User A" has 2 calendars: "User A", "User A - SHARED";
      3. "User B" create an event, with "User A" and "User A - SHARED" invited (images: screen1, screen2, screen3);
      4. "User A" revokes VIEW permission from User and Guest roles (images: screen4);
      5. "User B" trying to edit or viewing the event, but an exception was thrown (images: screen5, screen6):

       

      2020-10-01 07:44:37.106 ERROR [http-nio-8080-exec-5][PortletServlet:119] javax.portlet.PortletException: com.liferay.portal.kernel.security.auth.PrincipalException$MustHavePermission: User 37626 must have VIEW permission for com.liferay.calendar.model.Calendar 37694
      javax.portlet.PortletException: com.liferay.portal.kernel.security.auth.PrincipalException$MustHavePermission: User 37626 must have VIEW permission for com.liferay.calendar.model.Calendar 37694
      	at com.liferay.calendar.web.internal.portlet.CalendarPortlet.serveResource(CalendarPortlet.java:377)
      	at com.liferay.portlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:146)
      	at com.liferay.portlet.ScriptDataPortletFilter.doFilter(ScriptDataPortletFilter.java:88)
      	at com.liferay.portlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:140)
      	at com.liferay.portal.kernel.portlet.PortletFilterUtil.doFilter(PortletFilterUtil.java:78)
      	at com.liferay.portal.kernel.servlet.PortletServlet.service(PortletServlet.java:115)
      	at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
      	at org.eclipse.equinox.http.servlet.internal.registration.EndpointRegistration.service(EndpointRegistration.java:153)
      	at org.eclipse.equinox.http.servlet.internal.servlet.ResponseStateHandler.processRequest(ResponseStateHandler.java:62)
      	at org.eclipse.equinox.http.servlet.internal.context.DispatchTargets.doDispatch(DispatchTargets.java:120)
      	at org.eclipse.equinox.http.servlet.internal.servlet.RequestDispatcherAdaptor.forward(RequestDispatcherAdaptor.java:40)
      	at com.liferay.portlet.internal.InvokerPortletImpl.invoke(InvokerPortletImpl.java:567)
      	at com.liferay.portlet.internal.InvokerPortletImpl.invokeResource(InvokerPortletImpl.java:682)
      	at com.liferay.portlet.internal.InvokerPortletImpl.serveResource(InvokerPortletImpl.java:496)
      	at com.liferay.portal.monitoring.internal.portlet.MonitoringInvokerPortlet.serveResource(MonitoringInvokerPortlet.java:292)
      	at com.liferay.portlet.internal.PortletContainerImpl._serveResource(PortletContainerImpl.java:1077)
      	at com.liferay.portlet.internal.PortletContainerImpl.lambda$serveResource$4(PortletContainerImpl.java:267)
      	at com.liferay.portlet.internal.PortletContainerImpl._preserveGroupIds(PortletContainerImpl.java:425)
      	at com.liferay.portlet.internal.PortletContainerImpl.serveResource(PortletContainerImpl.java:260)
      	at com.liferay.portlet.SecurityPortletContainerWrapper.serveResource(SecurityPortletContainerWrapper.java:209)
      	at com.liferay.portlet.RestrictPortletContainerWrapper.serveResource(RestrictPortletContainerWrapper.java:150)
      	at com.liferay.portal.kernel.portlet.PortletContainerUtil.serveResource(PortletContainerUtil.java:232)
      	at com.liferay.portal.action.LayoutAction.processLayout(LayoutAction.java:409)
      	at com.liferay.portal.action.LayoutAction.execute(LayoutAction.java:173)
      	at com.liferay.portal.struts.PortalRequestProcessor._process(PortalRequestProcessor.java:408)
      	at com.liferay.portal.struts.PortalRequestProcessor.process(PortalRequestProcessor.java:154)
      	at com.liferay.portal.internal.servlet.MainServlet.doPost(MainServlet.java:214)
      	at javax.servlet.http.HttpServlet.service(HttpServlet.java:652)
      	at com.liferay.portal.internal.servlet.MainServlet.service(MainServlet.java:620)
      	at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
      	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:124)
      	at com.liferay.portal.remote.cors.internal.servlet.filter.PortalCORSServletFilter.processFilter(PortalCORSServletFilter.java:233)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.servlet.filters.password.modified.PasswordModifiedFilter.processFilter(PasswordModifiedFilter.java:62)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.servlet.filters.lockout.LockoutFilter.processFilter(LockoutFilter.java:58)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.servlet.filters.secure.BaseAuthFilter.processFilter(BaseAuthFilter.java:340)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.monitoring.internal.servlet.filter.MonitoringFilter.processFilter(MonitoringFilter.java:183)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilter.doFilter(InvokerFilter.java:104)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
      	at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:712)
      	at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:459)
      	at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:384)
      	at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:312)
      	at com.liferay.friendly.url.internal.servlet.FriendlyURLServlet.service(FriendlyURLServlet.java:475)
      	at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
      	at com.liferay.portal.servlet.ServletAdapter.service(ServletAdapter.java:99)
      	at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
      	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:124)
      	at com.liferay.portal.remote.cors.internal.servlet.filter.PortalCORSServletFilter.processFilter(PortalCORSServletFilter.java:233)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.servlet.filters.i18n.I18nFilter.processFilter(I18nFilter.java:368)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.servlet.filters.password.modified.PasswordModifiedFilter.processFilter(PasswordModifiedFilter.java:62)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.servlet.filters.lockout.LockoutFilter.processFilter(LockoutFilter.java:58)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.servlet.filters.secure.BaseAuthFilter.processFilter(BaseAuthFilter.java:340)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.servlet.filters.etag.ETagFilter.processFilter(ETagFilter.java:87)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.servlet.filters.autologin.AutoLoginFilter.processFilter(AutoLoginFilter.java:265)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.sharepoint.SharepointFilter.processFilter(SharepointFilter.java:88)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.servlet.filters.virtualhost.VirtualHostFilter.processFilter(VirtualHostFilter.java:248)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:147)
      	at com.liferay.portal.monitoring.internal.servlet.filter.MonitoringFilter.processFilter(MonitoringFilter.java:183)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:196)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:99)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:196)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:99)
      	at org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:176)
      	at org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:145)
      	at org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:92)
      	at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:389)
      	at com.liferay.portal.servlet.filters.urlrewrite.UrlRewriteFilter.processFilter(UrlRewriteFilter.java:65)
      	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:49)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:215)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:116)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:175)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:99)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:175)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:99)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:196)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:99)
      	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilter.doFilter(InvokerFilter.java:104)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
      	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
      	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
      	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
      	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
      	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
      	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
      	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
      	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
      	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
      	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
      	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1589)
      	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
      	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      	at java.lang.Thread.run(Thread.java:748)
      Caused by: com.liferay.portal.kernel.security.auth.PrincipalException$MustHavePermission: User 37626 must have VIEW permission for com.liferay.calendar.model.Calendar 37694
      	at com.liferay.portal.kernel.internal.security.permission.resource.DefaultModelResourcePermission.check(DefaultModelResourcePermission.java:54)
      	at com.liferay.calendar.service.impl.CalendarBookingServiceImpl.filterCalendarBooking(CalendarBookingServiceImpl.java:877)
      	at com.liferay.calendar.service.impl.CalendarBookingServiceImpl.getChildCalendarBookings(CalendarBookingServiceImpl.java:342)
      	at com.liferay.calendar.service.impl.CalendarBookingServiceImpl.getChildCalendarBookings(CalendarBookingServiceImpl.java:354)
      	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      	at java.lang.reflect.Method.invoke(Method.java:498)
      	at com.liferay.portal.spring.aop.AopMethodInvocationImpl.proceed(AopMethodInvocationImpl.java:50)
      	at com.liferay.portal.spring.transaction.TransactionInterceptor.invoke(TransactionInterceptor.java:69)
      	at com.liferay.portal.spring.aop.AopMethodInvocationImpl.proceed(AopMethodInvocationImpl.java:57)
      	at com.liferay.portal.kernel.aop.ChainableMethodAdvice.invoke(ChainableMethodAdvice.java:64)
      	at com.liferay.portal.spring.aop.AopMethodInvocationImpl.proceed(AopMethodInvocationImpl.java:57)
      	at com.liferay.change.tracking.internal.aop.CTTransactionAdvice.invoke(CTTransactionAdvice.java:80)
      	at com.liferay.portal.spring.aop.AopMethodInvocationImpl.proceed(AopMethodInvocationImpl.java:57)
      	at com.liferay.portal.spring.aop.AopInvocationHandler.invoke(AopInvocationHandler.java:49)
      	at com.sun.proxy.$Proxy872.getChildCalendarBookings(Unknown Source)
      	at com.liferay.calendar.web.internal.portlet.CalendarPortlet.serveCalendarBookingInvitees(CalendarPortlet.java:1303)
      	at com.liferay.calendar.web.internal.portlet.CalendarPortlet.serveResource(CalendarPortlet.java:345)
      	... 158 more
      

        
      Expected result: 
      "User B" should be able to load the event's information. Unviewable calendars, should be detached or hidden from the event.
       
      Actual result:
      For "User B", an exception is thrown and the event doesn't load correctly.
       

        Attachments

        1. screen1.png
          screen1.png
          59 kB
        2. screen1.png
          screen1.png
          59 kB
        3. screen1.png
          screen1.png
          59 kB
        4. screen1.png
          screen1.png
          59 kB
        5. screen2.png
          screen2.png
          63 kB
        6. screen3.png
          screen3.png
          13 kB
        7. screen4.png
          screen4.png
          29 kB
        8. screen5.png
          screen5.png
          24 kB
        9. screen6.png
          screen6.png
          7 kB

          Activity

            People

            Assignee:
            team-devrel Team Developer Relations
            Reporter:
            mirko.zizzari Mirko Zizzari
            Participants of an Issue:
            Recent user:
            Yunlin "Steven" Sun
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Days since last comment:
              46 weeks, 4 days ago

                Packages

                Version Package
                7.2.10 DXP FP11
                7.2.10.4 DXP SP4
                7.2.X
                7.3.10 DXP FP1
                7.3.10.1 DXP SP1
                7.3.6 CE GA7
                7.3.X
                Master