Notification email sent for file entry that user cannot view

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.0 M3
• Fix Version/s: 6.2.X EE, 7.0.0 M2
• Component/s: Application Security > Permissions, Security Vulnerability
• Labels:
  • QA-TP
  • liferay-fixpack-portal-168-6210
• Branch Version/s:
  6.2.x
• Backported to Branch:
  Committed
• Story Points: 10
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/21232

Steps to reproduce/Testing done

1. Configure an outgoing mail server for Liferay
2. Add a Documents and Media portlet to the page
3. Add a folder to the Documents and Media portlet
4. Add a document to the folder in the Documents and Media portlet
5. Go to Control Panel > Users & Organizations
6. Add a new user with a valid email address
7. Login to the new user and subscribe to the comments on the file added in step 5
8. On the admin user, make a comment on the file added in step 5
9. Verify that a notification email was sent to the new user's email address
10. Modify the permissions for the folder added in step 4 to remove all view permissions for roles other than the Owner
11. Make a comment on the file added in step 5
12. Verify that a notification email was sent to the new user's email address

Note: Notifications for comments (MBDiscussions) are currently not working in Master