Add Delete permissions to Blog Entries a to allow users with appropriate roles to delete images.

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.3.X, Master
• Fix Version/s: 7.3.X, 7.4.3.5 CE GA5, 7.4.13 DXP U1, Master
• Component/s: Blogs
• Labels:
  • ee-ts
  • liferay-fixpack-dxp-4-7310
  • liferay-update-dxp-1-7413
  • liferay-update-dxp-4-7310
  • pt-app-security-review
• Branch Version/s:
  7.3.x
• Backported to Branch:
  Committed
• Story Points: 1
• Fix Priority: 3
• Sprint: LIMA | QA Sprint 16
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/111315
• QA Test Name:
  • automated

Site and Portal Admins Not Able To Delete Blog Images

Description

Images in Content & Data > Blogs > Images cannot be deleted by Site and Portal Admins, unless they are the owner or are impersonating the owner. See attached .gifs.

Steps to reproduce

1. Start the Liferay Portal and Use the default test user
2. Create a blog post with an Image in the content.  This will add the image to the images tab in Blogs
3. Publish.
4. Switch to a Separate account with Site Administrator Privileges.
5. Go to Content & Data > Blogs > Images
6. Note that the Ellipsis menu for the recently added image does not exist and you cannot delete said image.
7. Give the user a custom role with all permissions enabled for Blogs
8. Note that the Ellipsis menu for the recently added image does not exist and you cannot delete said image.

Results of Testing

Expected Result:
Administrators and other Roles with DELETE permissions should be able to Delete images from Content & Data > Blogs > Images

Actual Results:
No one, except the owner of the image, or someone impersonating them could delete it.

Master

bb6d5d94bc1616a63f9980a4ad1c254d040d7893
Reproduced

Branch

7ebce09af7596811513ac3587cf6ae9cee6799f0
Reproduced