Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-27424

Comments not listed on asset publisher when permissions are enabled

    Details

      Description

      In an asset publisher with permissions enabled, comments are visible for administrator, but not for other users, even when they have the permissions to see the comments.

      I have dug a bit into this issue, and I believe it is a bug in MBMessageAssetRendererFactory.hasPermission, which is called in AssetEntryServiceImpl.filterEntryQuery used when filtering queries.

      Indeed, if I include the following code in my asset publisher display style

      mystyle.jsp
      		<div style="font-style:italic; border-top: thin; border-top-style:dotted; border-bottom: thin; border-bottom-style:dotted;">
      		assetEntry.getClassName : <%= assetEntry.getClassName() %> <br />
      		assetEntry.getClassPK : [<%=assetEntry.getClassPK()%>]<br />
      		Has permissionChecker view permission : <%= permissionChecker.hasPermission(0, assetEntry.getClassName(), assetEntry.getClassPK(), ActionKeys.VIEW) %><br />
      		Has assetRenderer permission : <%= assetRenderer.hasViewPermission(permissionChecker) %><br />
      		Has assetRendererFactory permission : <%= assetRendererFactory.hasPermission(
      			permissionChecker, assetEntry.getClassPK(), ActionKeys.VIEW) %><br />
      		</div><br />
      

      I get the following output for entries on comments for non-admin users (with enable permissions unchecked, of course)

      assetEntry.getClassName : com.liferay.portlet.messageboards.model.MBDiscussion
      assetEntry.getClassPK : [24296]
      Has permissionChecker view permission : false
      Has assetRenderer permission : true
      Has assetRendererFactory permission : false

      Hence as a workaround, I am considering patching my liferay portal to change the code

      AssetEntryServiceImpl.filterEntryQuery
      if (assetRendererFactory.hasPermission(permissionChecker, classPK, ActionKeys.VIEW)) {
        filteredEntries.add(entry);
      }
      

      by

      AssetEntryServiceImpl.filterEntryQuery
      if (assetRendererFactory.getAssetRenderer(classPK).hasViewPermission(permissionChecker)){
        filteredEntries.add(entry);
      }
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              michael.saechang Michael Saechang
              Reporter:
              alaindresse Alain Dresse
              Participants of an Issue:
              Recent user:
              Marta Elicegui
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Days since last comment:
                8 years, 37 weeks, 1 day ago

                  Packages

                  Version Package
                  6.2.0 CE M4