Authenticated users can view documents uploaded by guest users

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: Master
• Component/s: Forms, Security Vulnerability
• Labels: None
• Fix Priority: 4
• Sprint: Forms_7.4_07
• Git Pull Request: https://github.com/natocesarrego/liferay-portal/pull/964

Steps to reproduce

1. Go to Control Panel -> Users and Organizations -> Add User 
   1. Create a new user and save;
   2. Still on the edit page of the created user:
      • Go to Memberships -> Sites -> Select the option Liferay -> Save;
      • Go to Password and create a new password -> Save;
2. Go to Control Panel -> Instance Settings -> User Authentication 
   • Disable the option "Require strangers to verify their email address?"
3. Go to Content & Data > Forms -> Add a new Form
4. Add an Upload Field
5. Enable the option "Allow Guest Users to Send Files"
6. Publish the Form and copy the public URL created 
7. Log out and go to the public URL
8. Upload a file as a guest user
9. Submit the Form
10. Log in with the new User created previously
11. Go to the public URL
12. Click on the Select button of the Upload Field
13. Go to the Documents and Media tab
14. Navigate into the Forms folder
    • Path: com.liferay.dynamic.data.mapping.form.web -> Forms

Actual result
The authenticated user is able to view the documents uploaded by guest users in the Forms folder.

Expected result
There's no Documents and Media tab that the user can navigate

Obs.: We must test with a user other than Test because, as an admin, he is allowed to see all folders.