Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-130664

User without permission can see message thread if previously subscribed


    • Type: Regression Bug
    • Status: Verified
    • Resolution: Unresolved
    • Affects Version/s: Master
    • Fix Version/s: None
    • Component/s: Message Boards


      Steps to reproduce

      1. Add a Message Board portlet to a Widget page and create a new thread
      2. Go to the threads permissions and for "User" change the thread's permissions:
        1. Check "Subscribe" and "View" permissions for role "User"
        2. Check "View" permission for role "Guest" if not selected
      3. Add a new user and login as new user in another browser
      4. Subscribe to the thread as the new user
      5. As admin user, add a response message to the thread
      6. Change the thread's permission:
        1. Uncheck "Subscribe" and "View" permissions for "User" role
        2. Uncheck "View" permission for "Guest" role
      7. As the new user, access the reply message from URL link from the notification message

      Expected result:

      After clicking on the URL link from the notification page the user is redirected to a not found page and can't see the message thread

      Actual result:

      After clicking on the URL link from the notification page the user can see the message thread


      NOTE: The main thing is that the user without view permissions for the thread, user still can view the reply message thread in a widget page. 



        1. 20210415-131802.mp4
          1.94 MB
        2. 20210527-224013.mp4
          2.44 MB
        3. LPS-130664 - 03062021.mp4
          1.83 MB
        4. mb-permission-error.png
          19 kB

          Issue Links



              support-lep@liferay.com SE Support
              jeremy.chen Jeremy Chen
              Participants of an Issue:
              Recent user:
              Jeremy Chen
              Engineering Assignee:
              Adolfo Pérez
              0 Vote for this issue
              0 Start watching this issue


                Days since last comment:
                7 weeks, 6 days ago


                  Version Package