Affects Version/s: 7.1.X, 7.2.X, Master
When the attached workflow is saved the following is added to its source:
In released Liferay DXP 7.1 this piece of code is seemingly causing/involved in the workflow task being reassigned back to the creating user when the timer expires.
The workflow provided is as follows:
- This version of Single Approver has a scripted assignment that will assign to the admin user directly using the admin user's userId.
The "review" task has a timer action that is set for 5 minutes. This scripted action will print to the server log that it has executed and do nothing else.
Review the source after saving in Step 8. Notice the following tags have been added to the timer-action tag by the editor or system.
The addition of these tags is unexpected. These tags are not required in the timer-action tag based on the xsd located at: http://www.liferay.com/dtd/liferay-workflow-definition_7_1_0.xsd
1. Start an instance of Liferay DXP 188.8.131.52-sp2-fp12.
2. Log in as an admin user.
3. Create a new user and give them permission to add blog entries. (This will be the user submitting content.)
4. Create a site and place the blogs portlet on the main page.
5. Add the submitting user as a member of the site.
6. Obtain userId for admin user. (Admin user will be the approving user.)
7. Edit the Single Approver workflow and save. Paste the included source making sure to replace ###USER_ID### on line 126 with the userId from the previous step (Modified version is attached.)
Control Panel -> Configuration -> Workflow -> Edit -> Source Tab -> delete the current source and replace with the attached source.
8. Associate the single approver workflow with blog entries. Control Panel -> Configuration -> Workflow -> Schemes -> Edit (Blogs Entry) -> Select Single Approver -> Save.
9. Log into the portal as the submitting user.
10. Create a new blog entry and click Submit for Publication.
11. Log into the portal as the admin user.
12. The "review" task for the submitted blog entry should now appear in My Workflow Tasks. User Menu -> My Workflow Tasks -> Assigned to Me.
13. Wait 5 minutes while monitoring the server log. After 5minutes the line "5min timer executing" will appear in the server log.
14. Re-index searches so the index reflects the changes that have occurred. Control Panel -> Configuration -> Search - Reindex all search indexes.
15. Open My Workflow Tasks on the admin user. Notice the task to "review" the blog entry is no longer present.
16. Log into the portal as the submitting user. Open My Workflow Tasks. The "review" task has been reassigned to the submitting user, allowing the submitter to approve their own submission.
Expected Result: The valid xml definition will be saved without modification. The 5 minute timer action will execute and only print the line to the log. No other action should occur.
Actual Result: Additional tags are inserted into the workflow. When the timer executes an unexpected reassignment occurs where the "review" task is reassigned to the submitting user allowing them to approve their own content and bypass the approver.
The following prints into the log when the 5 minute timer expires:
5min timer executing
Does reproduce: df480f351261b354029bce77c8d809e1682f4ce8
Does reproduce: 8d941b089f8b0f03903d1b350d4d4b81f4f76556
Note: This issue has only been found reproducible on liferay EE versions.