Undeployed portlet referenced from page (after upgrade) throws exception in permission checker

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.0 CE GA1, 7.0.1 CE GA2
• Fix Version/s: 6.2.X EE, 7.0.1 CE GA2
• Component/s: Core Infrastructure > Permissions
• Labels:
  • liferay-fixpack-portal-164-6210
• Branch Version/s:
  6.2.x
• Backported to Branch:
  Committed
• Story Points: 1
• Fix Priority: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/39187
• Bug Type: Regression Bug

Steps to reproduce:

1. Sign in
2. Get guest groupId (e.g. 20233)
3. Get current p_auth token (e.g. 0fMsIhMD from page HTML source)
4. Exchange groupId and p_auth token and hit: http://localhost:8080/api/jsonws/layout/update-layout/group-id/20233/private-layout/false/layout-id/1/type-settings/column-1=181%0alayout-template-id=2_columns_ii?p_auth=0fMsIhMD
5. Display main page for guest group

Expected result: No exception in logs
Actual result: Exception stating that: Someone may be trying to circumvent the permission checker: {companyId=10155, name=118, primKey=118, scope=4}