It is possible to view its own object entry with the View Owner permission removed

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.4.3.16 CE GA16, Master
• Component/s: Objects
• Labels:
  • 7.4-known-issues
  • liferay-ga12-ce-743
  • liferay-ga13-ce-743-known-issue
  • liferay-ga14-ce-743-known-issues
  • liferay-ga15-ce-743-known-issues
  • qa_test_mapped
• Fix Priority: 4
• Git Pull Request: https://github.com/liferay-objects/liferay-portal/pull/417

Summary:
It is possible to view its own object entry with the View Owner permission removed

Steps to Reproduce:

1. Create an object with a field
2. Publish it
3. Go to Control Panel > Roles > Create a role
4. Click on Define Permissions > Search for the created object
5. Give the Access in Control Panel and Add Object Entry permissions
6. Go to Control Panel > Users and Organizations
7. Create a user and assign the created role to the user
8. Log in with the user
9. Add an entry on the object
10. Log in with Test Test
11. Remove the Access in Control Panel and Add Object Entry permissions from the created role
12. Go to the Object portlet
13. Click on the kebab menu from the entry > Permissions
14. Remove the View Owner permission
15. Save it
16. Log in with the user
17. Go to the object portlet

Expected Result:
User cannot view the entry

Actual Result:
User can view the entry

Verified on master: 9343a25f6b971908978fa61c87bdd11468aa9d22