Private page of type "Link to URL" is publicly available

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.2.X EE, 7.0.0 M5
• Fix Version/s: 6.2.4 CE GA5, 6.2.X EE, 7.0.0 M5
• Component/s: Security Vulnerability
• Labels:
  • liferay-fixpack-portal-49-6210
  • security-filter-vulnerabilities
• Branch Version/s:
  6.2.x
• Backported to Branch:
  Committed
• Story Points: 9
• Fix Priority: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/25183

Guest users accessing directly a private site page of type "Link to URL" are able to overcome portal authentication and are redirected to the linked URL.

Steps to reproduce:

1. Add a private page to your site with Name="URLPage", Type="Link to URL" and URL="http://www.google.com";
2. Sign out;
3. Enter the URL http://localhost:8080/group/guest/urlpage;

Expected result:

As the user is not authenticated, he should not be able to access this portal private resource and should be redirected to the login page.

Actual result:

Even though the defined page is private, guest user accesses it and redirection happens.