User can perform actions on user group that they have no permission

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.3.X, Master
• Fix Version/s: 7.4.0 CE GA1, 7.4.13 DXP GA1, 7.4.3.5 CE GA5, 7.4.13 DXP U1, 7.4.3.6 CE GA6, 7.4.13 DXP U2, Master
• Component/s: User Management > Roles, User Management > User Groups
• Labels:
  • 7.4-blocker
  • QA-AUTOMATION
  • usm-metrics-out
• Fix Priority: 5
• Git Pull Request: https://github.com/drewbrokke/liferay-portal/pull/1337
• Bug Type: Regression Bug
• QA Test Name:
  • LocalFile.UsergroupsUsecase#ViewUserGroupPermissionsNoAsUser
• QA Test Score: 4
• Quality Gate: Release Testing

Steps to Reproduce

1. Add a user group: User Group 1
2. Add a reg role with following permissions
   1. Portal: View Control Panel Menu
   2. User Groups: Access in Control Panel
   3. User Groups > User Group: View
3. Add a user: User1 with the role assigned
4. Login or Impersonate User1
5. Go to Control Panel > Users > User Groups
6. Assert User Group 1 listed
7. Assert User1 can perform actions on User Group 1