Liferay responds with internal error when user does not have permissions for retrieving experiences in APIs

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.1.10 DXP FP23, 7.1.10.6 SP6, 7.1.X, 7.2.10 DXP FP12, 7.2.X, 7.3.7 CE GA8, 7.3.10 DXP FP2, 7.3.X, 7.4.0 CE GA1, Master
• Component/s: Headless Delivery API
• Labels:
  • liferay-dxp-71-sp6
  • liferay-fixpack-dxp-12-7210
  • liferay-fixpack-dxp-2-7310
  • liferay-fixpack-dxp-23-7110
• Branch Version/s:
  7.3.x, 7.2.x, 7.1.x
• Backported to Branch:
  Committed
• Fix Priority: 3
• Git Pull Request: https://github.com/liferay-headless/liferay-portal/pull/616

When a user tries to retrieve the experiences endpoint for a page and does not have permissions, the user gets a 500 internal error. It should get a 403

 

Steps to reproduce

1.- Create a content page ("page1") and add at least one experience

2.- Create a user ("user1") with no roles 

3.- Request with user1, the page1 experiences in "http://localhost:8080/o/headless-delivery/v1.0/sites/20124/site-pages/page1/experiences"

 

Current behavior

**the server answers with an exception with 500 error

 

Expected behavior

the server answers with an exception with 403 error