Site member inherits permissions from the Guest role on the private pages

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.0 DXP SP2, Master
• Fix Version/s: 7.0.0 DXP SP2, 7.0.0 DXP FP13, 7.0.0 DXP SP3, 7.0.3 CE GA4, 7.1.X, Master
• Component/s: Widget configuration
• Labels:
  • QA-FP
  • liferay-digital-enterprise-70-sp3
  • liferay-fixpack-de-13-7010
• Branch Version/s:
  7.0.x
• Backported to Branch:
  Committed
• Story Points: 1
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/46103

When permissions.check.guest.enabled is set to true in portal.properties Site Member inherits permissions from the Guest role, but on the private pages there is no way to configure Guest role permissions.

Steps to reproduce:

1. Set "layout.show.portlet.access.denied=false" in portal-ext.properties and start the bundle.
2. Go to Control Panel -> Sites -> Sites.
3. Click Add button -> Blank Site.
4. Fill in the Name "test site" and save it.
5. Go to test site -> Navigation.
6. Create a private page named "test page".
7. Go to the page and add a web content display portlet to the page.
8. Open the configuration menu and click Permissions.
9. Unflag the View permission of Guest and Site Member, click save (only Owner should have View permission).
10. Add a web content in the portlet.
11. Go to Control Panel -> Users and Organizations.
12. Click Add button, create a user "test2".
13. Select "test site" under Sites and click Save.
14. Login as "test2" and go to "test page".

Expected result:
You cannot see the Web Content Display portlet.

Actual result:
You can see the Web Content Display portlet.

Note: In public page, if we unflag the View permission of Guests, and follow the step above, we will not see the portlet. But in private page, there is no Guests permissions in portlet setting.