Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
Major
-
Resolution: Won't Fix
-
Affects Version/s: 5.1.2, 5.2.2
-
Fix Version/s: 5.2.3
-
Component/s: -- none --
-
Labels:None
-
Environment:Liferay 5.2.2
Tomcat 6.0.18
-
Similar Issues:
Description
When adding new Layout, there are always GUEST permissions added to the resource:
resourceLocalService.addResources(
user.getCompanyId(), groupId, user.getUserId(),
Layout.class.getName(), layout.getPlid(), false, true, true);
You can notice the last true in the call which means "add guest permissions". Therefore the addGuestPermissions method is executed:
The solution should be:
resourceLocalService.addResources(
user.getCompanyId(), groupId, user.getUserId(),
Layout.class.getName(), layout.getPlid(), false, true, !layout.isPrivateLayout());
Next possible solution could be to implement filterGuestPermission method in PermissionListFilterImpl so as it filters private layouts:
Activity
I understand, but this is not clear solution and there is a chance it should cause problems in other places than only when showing private pages.
Example 1: For our customer I've implemented search for pages' names. In search you can't use check that is used for accessing private pages - the only way you can rely on is to use roles and permission system, which is not working correctly in this case 
Example 2: For the same customer we extended Site map to show all pages in all orgs. It is more general (and simple) to list all pages of all organizations and filter them using permissions than to make checks on user, whether he belongs to that organization (or descendant) and to show private pages or not.
This fix is not need since private pages are only accessible by authenticated users who belong to organization/community.