User is unable to query assigned teams

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.2.X, 7.3.X, Master
• Fix Version/s: 7.2.X, 7.3.10 DXP U19, 7.3.X, 7.4.13 DXP U53, Master
• Component/s: Site Teams, Web Services > JSON WS
• Labels:
  • 7.3.10-u19
  • 7.4.13-u53
  • ee-ts
  • liferay-fixpack-dxp-19-7310
  • liferay-update-dxp-19-7310
  • pt-app-security-review
• Branch Version/s:
  7.3.x, 7.2.x
• Backported to Branch:
  Committed
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/126781
• Bug Type: Default

Description:

When using the JSON WS to query for a user's own teams, if the groupId is specified, then the user will not be able to view their teams due to a PrincipalException like:

User XXXXX must have MANAGE_TEAMS permission for com.liferay.portal.kernel.model.Group YYYYY

This shouldn't occur, since the same API without the groupId works fine

It's been determined in PTR-3460, the solution will we to allow the user to view the teams for the specified user assuming they have UPDATE permission for them as well.

Steps to reproduce

1. Create a user and assign it to some groups
2. Go to http://localhost:8080/api/jsonws and select get-user-teams method
3. Place the userId and groupId and see if the same occurs

Expected Results:
teams are returned

Actual results:
No teams are shown and a principal exception is thrown.

 

Reproduced in master c1e7129f0993aa30e3f345ebd66fd58bc005e8e5