User is shown a RequiredUserException instead of a PrincipalException when attempting to steal an admin account

• Type: Bug
• Status: Closed
• Resolution: Won't Fix
• Affects Version/s: 7.0.0 M3
• Fix Version/s: None
• Component/s: Web Services, Web Services > JSON WS
• Labels:
  • QA-AUTOMATION
  • ee-7.0.x
  • known-issues
  • master
  • portal-security-ki
• Fix Priority: 5
• Bug Type: Regression Bug

Steps to reproduce:
1. Sign in
2. Hit http://localhost:8080/api/jsonws
3. Click the first 'add-address' service
4. Copy the pAuth value
5. Hit http://localhost:8080/c/portal/json_service?serviceClassName=com.liferay.portal.service.UserServiceUtil&serviceMethodName=updateStatus&serviceParameters=[userId,status]&userId=10202&status=6&p_auth=[[paste pAuth value here]]

Expected result:

{"message":"com.liferay.portal.security.auth.PrincipalException","exception":"com.liferay.portal.security.auth.PrincipalException"}

Actual result:

{"throwable":"com.liferay.portal.RequiredUserException","error":{"message":"com.liferay.portal.RequiredUserException","type":"com.liferay.portal.RequiredUserException"},"exception":"com.liferay.portal.RequiredUserException"}