Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-159082

User can bypass account restrictions and create entries related to any account using the headless API

Details

    Description

      Steps:

      1. Create an Account titled Account A
      2. Create an Account titled Account B
        1. Note the account ID, "$accountId"
      3. Create a new Object, Object A
      4. From Account, create a one to many relationship with Object A, "Relationship A"
      5. In Object A, activate Account Restriction and set it to the relationship created in the previous step
      6. Add a text field, titled "Text Field"
      7. Create a default layout with both fields
      8. Publish
      9. Create a new User, "UserA"
        1. Grant the power user role to "UserA"
        2. Grant "Add Object Entry" permissions for "Object A" to the power user role
      10. Add "UserA" to "Account A"
      11. Go to localhost:8080/o/api > REST Applications > c/objectas
      12. Execute the following in postObjectA
        {
          "r_relationshipA_accountEntryId": "$accountId",
          "textField": "hello world"
        }
        

      Expected result:
      Expected the request to fail gracefully.

      Actual result:
      The entry is created.

      Reproduced on:
      Tomcat 9.0.56 + MySQL 5.7
      Portal master GIT ID: e9a5492319dcfab370b8c5ae5cf26b79237f8531

      Attachments

        Issue Links

          Activity

            People

              timothy.pak Timothy Pak
              timothy.pak Timothy Pak
              Kiyoshi Lee Kiyoshi Lee
              Mateus Santana Mateus Santana
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                8 weeks, 3 days ago

                Packages

                  Version Package
                  7.4.3.37 CE GA37
                  Master