Draft Articles w-o an Approved Version will not appear to Non-Content Reviewers when Searching

• Type: Bug
• Status: Verified
• Resolution: Unresolved
• Affects Version/s: 7.0.0 DXP FP30, 7.0.0 DXP FP95, 7.0.X, 7.2.10.3 DXP SP3, 7.2.X, 7.3.10 DXP GA1, 7.3.X, Master
• Fix Version/s: None
• Component/s: Content Display Widgets > Web Content Search widget
• Labels:
  • 7.1-won't
  • QA-V
• Fix Priority: 1

Draft Articles without an Approved Version will not appear to Non-Content Reviewers when Searching in the Web Content Portlet, however the Draft Articles will appear in the default results in the Portlet. Their presence should be consistent between the two result sets.

Steps to Reproduce

1. Go to Site -> Content -> Web Content
2. Click the button to add a Basic Web Content
3. Name the Content "Approved-Draft 1.0" and enter some Content then Publish
4. Edit the Web Content and change the name to "Approved-Draft 1.1" and Save as Draft
5. Go to Site -> Content -> Web Content
6. Click the button to add a Basic Web Content
7. Name the Content "Draft Only 1.0" and enter some Content then Save as Draft
8. Go to Control Panel -> Users -> Roles
9. Create a Role "Non-Content Reviewer"
10. Go to Define Permissions and Search for Web Content then click on the result
11. Add the Permissions: Web Content -> General Permissions -> Access in Site Administration and Save
12. Go to Control Panel -> Users -> Users and Organizations
13. Add a new User
14. Assign the User the Role Non-Content Reviewer
15. Impersonate or Sign in with that new User and go to Site -> Content -> Web Content
16. Change the filter on the search from "Approved" to "Draft"
17. Notice both "Approved-Draft 1.1" and "Draft Only 1.0" appear
18. Use the Search in the upper left corner to search for "draft"
19. Change the filter on the search from "Approved" to "Draft"

Expected Results
The same 2 articles would appear: "Approved-Draft 1.1" and "Draft Only 1.0"
Actual Results
Only "Approved-Draft 1.1" appears

Additional Notes
LPS-40995 added a permission check for the Update permission when a User tries to view a Journal Article here: https://github.com/liferay/liferay-portal/commit/7a0e61c2fe4bba6f6877fed1d805149d87550a91
This code is checked when the Articles are being searched with Elastic Search for a keyword, but not when the database is hit directly for the default results. I am not sure why having an Approved Version of a Journal Article gives a Non-Content Reviewer permission to Update it's Draft.

Reproduced: Master 362b59cae0c6