Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-48881

My Account is accessible when a Workflow Task is submitted even when user lacks view permissions



      Issue: Users are able to access "My Account" if a Workflow item has been submitted by them. This occurs if portlet.add.default.resource.check.enabled=true is still set, and if all My Account permissions are removed for the user. It would appear that this should not be accessible to the user.

      1. In the portal-ext.properties file, set portlet.add.default.resource.check.enabled=true
      2. Navigate to Control Panel -> Roles -> User -> Define Permissions -> My Account
      3. Select My Account in the left-hand column, and remove all permissions for all the different permissions under My Account (e.g. My Account > Account Settings > view, etc.)
      4. Navigate to Control Panel Workflow > Default Configuration and configure the Message Board portlet to use a Single Approver Workflow.
      5. Create a new user who is not an Administrator
      6. Navigate to the front page and add a Message Boards Portlet. Make sure users have the necessary permissions to add a thread
      7. Login with a non-admin user, and verify there is no My Account link option.
      8. Create new message board thread and submit for publication.

      Expected Result: Users do not have the ability to navigate to "My Account"
      Actual Result: Users can navigate to "My Account" and can see their "Pending Tasks"

      Tested in 6.2.x and Trunk
      Reproduced in 6.2.x and Trunk

      trunk commit 21d425e4d8cbbd172e7ed8919dc1cd0e0a9df253
      6.2.x commit 27cd3794f7d2d21d39f97943379e585c3af3ffc2


          Issue Links



              joshua.gok Joshua Gok (Inactive)
              joshua.gok Joshua Gok (Inactive)
              Participants of an Issue:
              Recent user:
              Esther Sanz
              0 Vote for this issue
              0 Start watching this issue


                Days since last comment:
                6 years, 47 weeks, 6 days ago


                  Version Package
                  6.2.10 EE GA1
                  7.0.0 M3