RefreshURL doesn't include p_p_auth token

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.0 DXP GA1, 7.0.0 DXP SP2, Master
• Fix Version/s: 7.0.0 DXP FP10, 7.0.0 DXP SP2, 7.0.3 CE GA4, 7.1.X, Master
• Component/s: Application Security, Core Infrastructure
• Labels:
  • liferay-digital-enterprise-70-sp2
  • liferay-fixpack-de-10-7010
• Branch Version/s:
  7.0.x
• Backported to Branch:
  Committed
• Story Points: 1
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/45923

Steps to reproduce:

1) Get DXP vanilla
2) Start it, login as OmniAdmin
3) Place an Activities portlet onto the Welcome page
4) Create another page and place a Wiki page on it
5) Edit the Wiki's Front Page, add some content and Publish, then comment on it
6) Navigate to the Welcome page, an activity such as "Alfonso commented on a wiki page, this is a test ...." should appear
7) Click on the part of text saying "this is a test ....", you'll be redirected to the actual Wiki. In the address bar, a link such as http://localhost:8080/group/guest/welcome/-/wiki/34277/FrontPage/maximized?p_p_auth=j3LBZodj will appear
8) Comment on the Wiki and click on "Reply"

Expected result: The same as it happens when commenting on a Wiki without reaching it from the Activities portlet: comment to be posted, page to reload, message "Your request completed successfully." to be shown

Actual result: Comment will be posted, page will not reload and will show "You do not have the roles required to access this portlet."

The reason is that the request to render the portlet does not contain p_p_auth token.