User has option to Delete Kaleo Form filled in form without permission

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.0 DXP SP7, 7.0.0 DXP FP50, 7.0.X, 7.1.0 Beta 3, 7.1.X
• Fix Version/s: 7.2.10 DXP FP1, 7.2.X, Master
• Component/s: Business Productivity > Kaleo Workflow Forms
• Labels:
  • QA-V
  • SMEQAFP3
  • liferay-fixpack-dxp-1-7210
  • profiq
  • pt-app-security-review
• Branch Version/s:
  7.2.x
• Backported to Branch:
  Committed
• Story Points: 1
• Fix Priority: 3
• Sprint: Workflow_7.2_14, Workflow_7.2_13
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal-ee/pull/24817

Prerequisites:

1. Create new basic user
2. Set User role permissions as in gif

 
Steps:

1. As admin, navigate to Content -> Kaleo Forms Admin
2. Create new Form
3. View created Form
4. Add new form, fill in some fields, save it
5. Go back to Kaleo Forms Admin
6. From action menu, select Permissions
7. Set Permission for user to View Form (optionally also Delete, because it doesn't make any difference at all)
8. Login as user, access Kaleo Forms Admin
9. Select View from action menu of Form
10. Select Delete from action menu of filled in specific form

2018-06-15 09:29:16.823 ERROR [http-nio-8080-exec-1][PortletServlet:112] javax.portlet.PortletException: com.liferay.portal.kernel.security.auth.PrincipalException$MustHavePermission: User 36215 must have DELETE permission for com.liferay.dynamic.data.lists.model.DDLRecordSet 36112
javax.portlet.PortletException: com.liferay.portal.kernel.security.auth.PrincipalException$MustHavePermission: User 36215 must have DELETE permission for com.liferay.dynamic.data.lists.model.DDLRecordSet 36112

Expected result: There is no option for user to delete filled in form / there is error message displayed / user can delete form
Actual result: Page is not displayed correctly, no error message, filled in form is not deleted

Reproducible:

• CentOS, MySQL 5.6, Tomcat 9.0.6, FF 60
• DXP 7.1-b3-20180611120257571

Fix priority: S3 + L3 = 3