Permissions for Documents and Media home directory are not checked during search

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.30 EE GA3, 6.2.0 CE RC2, 6.2.0 CE GA1
• Fix Version/s: 6.1.X EE, 6.2.2 CE GA3 , 6.2.X EE, 7.0.0 M1
• Component/s: Collaboration, Security Vulnerability, WCM
• Labels:
  • 6.1_release_notes
  • QA-R
  • QA-TP
  • backend_test
  • ee-ts
  • liferay-fixpack-collaboration-15-6210
  • liferay-fixpack-document-management-13-6210
  • liferay-fixpack-misc-7-6210
  • liferay-fixpack-platform-29-6210
  • liferay-fixpack-portal-32-6130
  • liferay-fixpack-web-content-14-6210
• Environment: Tomcat 7 + MySQL 5. Portal 6.2.x GIT ID: 93ed2fe35b30c9134e84335fbb0c98d03ecdbc6f.
• Branch Version/s:
  6.2.x, 6.1.x
• Backported to Branch:
  Committed
• Story Points: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/15405

Steps to Reproduce:
1. Add the Documents and Media and the Search portlets to a page.
2. Edit the permissions on the Home directory of the document library. Uncheck all of the boxes under "View" so that no one has the permission to view. (Admin will still be able to view)
3. Add a basic document to the Home directory.
4. Add a subfolder to the Home directory. (view permissions on the subfolder should be granted to test if the permissions from the Home directory are being inherited)
5. Add a document to the subfolder.
6. Sign out so that you are viewing the site as a guest.
7. Search for the names of the documents you created.

Expected Result:
That there would be no results in the search when permissions.view.dynamic.inheritance=true (which is the default)

Actual Result:
The search returns the documents you created. This allows you to select and download the document as well.