Removing and re-adding account role permission makes Group Scope permission disappear

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.4.3.22 CE GA22, Master
• Component/s: User Management > Roles
• Labels:
  • pt-app-security-review
• Fix Priority: 4
• Git Pull Request: https://github.com/liferay-usm/liferay-portal/pull/529

For reproducing this bug, you can take as example the following steps that are related to a Commerce use case:

 

STEPS TO REPRODUCE:

1. Go to Application Menu -> Control Panel -> Roles;
2. Go to Account Roles;
3. Click "Buyer";
4. Go to Define Group Scope Permissions;
5. Assert Open Carts > Commerce Orders: View Order Type is present;
6. Go to Define Permissions;
7. Remove, for example, Open Carts > Commerce Orders: View Billing Address;
8. Click any Open Carts > Commerce Orders link;
9. Reassign View Billing Address
10. Save;
11. Go to Define Group Scope Permissions

 

EXPECTED BEHAVIOUR:

Open Carts > Commerce Orders: View Order Type  is still present

 

ACTUAL BEHAVIOUR:

Open Carts > Commerce Orders: View Order Type is no longer present, in fact a Buyer user is no longer able to create orders with OTs. 

 

 

FURTHER INFORMATION:

At point 8 you can actually see that in the last permissions box (Order Types), the View permission is not checked. Then if you check it the user will be able to see OTs yet Define Group Scope Permissions will be still missing the permission.