Site-specific roles are visible in Announcement Portlets to Site Admins that are not a member of those sites.

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.X, Master
• Fix Version/s: 7.0.0 DXP FP52, 7.0.0 DXP SP9, 7.0.X, 7.1.10 DXP FP1, 7.1.X, Master
• Component/s: Announcements & Alerts widgets
• Labels:
  • ee-ts
  • liferay-dxp-70-sp9
  • liferay-fixpack-de-52-7010
  • liferay-fixpack-dxp-1-7110
• Branch Version/s:
  7.0.x
• Backported to Branch:
  Committed
• Story Points: 1
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/60357

Reproduction Steps:

1. Create two sites - "Site1" and "Site2".
2. Create a team in "Site1" - "Site1 Team".
3. Create a new user - "User"
4. Add "User" to "Site2". Make "User" a member of "Site2" and assign them the role of site admin.
5. Add a page to "Site2" and place an Announcements Portlet on that page.
6. Log-in as "User". Go to "Site2".
7. On "Site2" click "Manage Entries" on the Announcements Portlet. Open the "Distribution Scope" selector-"Site1 Team" is available.

Expected Results: "Site1 Team" should not be visible/available to the user.

Actual Results: "Site1 Team" is available. Portlet crashes if user tries to publish an announcement to that scope.

 

Note: Reproduction steps above only work for 7.0.x due to changes in the UI and LPS-82112, but logic that needs to be fixed is identical in Master as in 7.0.x.