Portlet configuration button shows for non-admin user when preferences-unique-per-layout is false and user does not have configuration permissions for the portlet

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.X EE, 6.2.X EE, 7.0.0 M4
• Fix Version/s: 6.1.X EE, 6.2.3 CE GA4, 6.2.X EE, 7.0.0 M4
• Component/s: Core Infrastructure, Security Vulnerability
• Labels:
  • 6.1_release_notes
  • liferay-fixpack-portal-35-6130
  • liferay-fixpack-portal-40-6210
• Branch Version/s:
  6.2.x, 6.1.x
• Backported to Branch:
  Committed
• Story Points: 16
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/23758

Steps to Reproduce:

1. Create a Liferay portlet and modify the liferay-portlet.xml to include:

   <preferences-unique-per-layout>false</preferences-unique-per-layout>
   

2. Startup Liferay and login as admin user
3. Deploy the portlet created in step 1
4. Navigate to Admin > Pages > Private Pages tab
5. Add a page to 'Private Pages'
6. Select the page, click 'Permissions' and check the 'Customize' permission for the Power User role
7. On the side menu to the right, click 'Customization Settings' for the created page and set 'column-2' as customizable
8. View the newly created private page Note: Be sure to view the default page (set in the dockbar at the top of the page)
9. Add the created portlet to the column-2 (set as customizable in step 7)
10. From Control Panel add a new user and add the Liferay site
11. Login as newly created user. Navigate to Liferay Private Pages Note: For this step do not view the default page
12. At this point you should see the custom Liferay portlet in column-2. Click the gear icon, and you should see the 'Look and Feel', 'Customize' and 'Remove' buttons.

Expected Results: The 'Customize' button should not appear when the user clicks the gear icon for the portlet. This is because the user does not have permissions to customize the portlet.
Actual Results: The 'Customize' button and 'Look and Feel' buttons appear when the user clicks the gear icon for the portlet.