User with multiple roles might receive incorrect permission errors

• Type: Bug
• Status: Closed
• Resolution: No Longer Reproducible
• Affects Version/s: 7.1.10 DXP FP1, 7.1.X, Master
• Fix Version/s: Master
• Component/s: Application Security > Permissions
• Labels: None
• Fix Priority: 3

Steps to Reproduce:

1. Add a new user
2. Assign user to the "Administrator" role
3. Define a password to allow login
4. Go to Control Panel > Users > Roles
5. Create a new role with no permissions
6. Edit the previously created user
7. Assign to the new role (will now have both Administrator role and new role)
8. Login to the new user
9. Go to Liferay > Content > Web Content
10. Add a new article
11. Go to Welcome page
12. Add a Web Content Display widget
13. Attempt to select the created web content for the widget

Expected Result:
User with Administrator role can select a web content for display.

Actual Result:
Permissions error will be thrown when attempting to select the web content. Web content is not selected.

2018-09-05 18:33:19.064 WARN  [WebContainer : 4][SecurityPortletContainerWrapper:393] User 36110 is not allowed to access URL http://localhost:8080/web/guest/home and portlet com_liferay_portlet_configuration_web_portlet_PortletConfigurationPortlet
2018-09-05 18:33:19.068 ERROR [WebContainer : 4][PortletConfigurationPortlet:677] null

The error will not occur if the user only has the Administrator role, the second role causes the issue.

Reproduced on:
7.1 DXP + FP1
Master: bdf4cd860e3ad1f72bfdf5fdef01966ae6cf26b6