Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-130664

User without permission can see message thread if previously subscribed

    Details

    • Type: Regression Bug
    • Status: Verified
    • Resolution: Unresolved
    • Affects Version/s: Master
    • Fix Version/s: None
    • Component/s: Message Boards

      Description

      Steps to reproduce

      1. Add a Message Board portlet to a Widget page and create a new thread
      2. Go to the threads permissions and for "User" change the thread's permissions:
        1. Check "Subscribe" and "View" permissions for role "User"
        2. Check "View" permission for role "Guest" if not selected
      3. Add a new user and login as new user in another browser
      4. Subscribe to the thread as the new user
      5. As admin user, add a response message to the thread
      6. Change the thread's permission:
        1. Uncheck "Subscribe" and "View" permissions for "User" role
        2. Uncheck "View" permission for "Guest" role
      7. As the new user, access the reply message from URL link from the notification message

      Expected result:

      After clicking on the URL link from the notification page the user is redirected to a not found page and can't see the message thread

      Actual result:

      After clicking on the URL link from the notification page the user can see the message thread

       

      NOTE: The main thing is that the user without view permissions for the thread, user still can view the reply message thread in a widget page. 

       

        Attachments

        1. 20210415-131802.mp4
          1.94 MB
        2. 20210527-224013.mp4
          2.44 MB
        3. LPS-130664 - 03062021.mp4
          1.83 MB
        4. mb-permission-error.png
          mb-permission-error.png
          19 kB

          Issue Links

            Activity

              People

              Assignee:
              support-lep@liferay.com SE Support
              Reporter:
              jeremy.chen Jeremy Chen
              Participants of an Issue:
              Recent user:
              Jeremy Chen
              Engineering Assignee:
              Adolfo Pérez
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Dates

                Created:
                Updated:
                Days since last comment:
                7 weeks, 6 days ago

                  Packages

                  Version Package