Relationship field and tab are displayed when user does not have access to all the objects involved

• Type: Bug
• Status: Closed
• Resolution: Won't Fix
• Affects Version/s: Master
• Fix Version/s: None
• Component/s: Objects
• Labels:
  • 7.4-known-issues
  • liferay-ga10-ce-743
  • liferay-ga11-ce-743
  • liferay-ga12-ce-743
  • liferay-ga13-ce-743-known-issue
  • liferay-ga14-ce-743-known-issues
  • liferay-ga15-ce-743-known-issues
  • liferay-ga16-ce-743-known-issues
  • liferay-ga17-ce-743-known-issues
  • liferay-ga18-ce-743-known-issues
  • liferay-ga19-ce-743-known-issues
  • liferay-ga20-ce-743-known-issues
  • liferay-ga21-ce-743-known-issues
  • liferay-ga22-ce-743-known-issues
  • liferay-ga23-ce-743-known-issues
  • liferay-ga24-ce-743-known-issues
  • liferay-ga25-ce-743-known-issues
  • liferay-ga26-ce-743-known-issues
  • liferay-ga27-ce-743-known-issues
  • liferay-ga28-ce-743-known-issues
  • liferay-ga29-ce-743-known-issues
  • liferay-ga30-ce-743-known-issues
  • liferay-ga31-ce-743-known-issues
  • liferay-ga32-ce-743-known-issues
  • liferay-ga33-ce-743-known-issues
  • liferay-ga34-ce-743-known-issues
  • liferay-ga35-ce-743-known-issues
  • liferay-ga8-ce-743
  • liferay-ga9-ce-743
• Fix Priority: 4

Summary:
Relationship field and tab are displayed when user does not have access to all the objects involved

Steps to Reproduce:

1. Go to Object Admin
2. Create an Object A with a field and an Object B with a field
3. Create a relationship One-To-Many from Object A to Object B
4. Go to Object A > Layouts > Create a Layout with the Relationship tab
5. Publish both objects
6. Create an Object C with a field and an Object D with a field
7. Create a relationship One-To-Many from Object C to Object D
8. Publish both objects
9. Add some entries on all the objects
10. Go to Control Panel > Roles > Create a Regular Role
11. Click on "Define Permissions" > Search for Object A > Give all the permissions and save
12. Search for Object D > Give all the permissions and save
13. Go to Control Panel > Users and Organizations
14. Create an User A and assign the created role to it
15. Log in on User A
16. Go to Object A > Click to edit an entry > Click on the Relationship tab > Click to add an entry
17. Go to Object D > Click to edit or add a new entry

Expected Result:
Relationship field and tab are not displayed

Actual Result:
Relationship field and tab are displayed

Verified on master: 52c435261679ed9eb62b7aafb24b0b8d2fe357aa