Users with only view permissions for Pages can mark pages as Home Page still

• Type: Bug
• Status: Closed
• Resolution: Duplicate
• Affects Version/s: Master
• Fix Version/s: None
• Component/s: Application Security > Permissions, Pages > Page Administration
• Labels: None

Description
With the re-added feature to Mark Pages as a "Home Page" we may have forgot to reset its permission properties. Currently, users with only view permissions for Pages (and Pages Administration) can mark pages as the default Home Page for the Site. The fact that they still can't edit or configure the page reinforces that this is probably a bug.

Steps to Reproduce

1. Create a User with only Page View Permissions and the ability to access the Pages Admin from Site Admin
2. Impersonate / Log in as the user
3. Assert that Site Pages can be viewed and not Editable / Configurable (If this assertion fails, retry the steps)
4. Try to mark page as "Home Page"

Expected Result
You can't mark page as "Home Page"

Actual Result
You can mark page as "Home Page"

Reproduced on Tomcat 9.0.6 + MySQL 5.7
Portal master GIT ID: 3e0ccd1533b5e753016c3444ba6b2c38a56e105e