PACL - PortalDelegateServlet does not work when PACL is enabled

• Type: Regression Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.X EE, 6.2.0 CE B2
• Fix Version/s: 6.1.2 CE GA3, 6.1.30 EE GA3, 6.1.X EE, 6.2.0 CE B2
• Component/s: Application Security > LDAP, Application Security > PACL, Security Vulnerability
• Labels:
  • QA-R
  • QA-TP
• Environment: Any
• Branch Version/s:
  6.1.x
• Backported to Branch:
  Committed
• Story Points: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/12989 https://github.com/brianchandotcom/liferay-portal-ee/pull/1775

Steps:

• create a plugin with a web.xml which contains

      <servlet>
          <servlet-name>My Servlet</servlet-name>
          <servlet-class>com.liferay.portal.kernel.servlet.PortalDelegateServlet</servlet-class>
          <init-param>
              <param-name>servlet-class</param-name>
              <param-value>my.Servlet</param-value>
          </init-param>
          <init-param>
              <param-name>sub-context</param-name>
              <!-- servlet will be available on the path /{liferayContext}/delegate/myservlet -->
              <param-value>myservlet</param-value>
          </init-param>
          <load-on-startup>1</load-on-startup>
      </servlet>
  

• set the plugin to enable PACL (security-manager-enabled=true)
• deploy the plugin
• attempt to access the servlet
• you should get an error