资产发布者的权限问题

Question

Following are the steps to reproduce the permission issue with Asset Publisher:

1. Create site and assign power user to this site.
2. Create two public pages. Home and blogs.
3. Add Asset publisher and Blog portlet on those pages.
4. Through Administrator account like test user create a blog and then remove view permission for Guest and Site member.
5. Log in with power user which was assign to this site in Step 1.
6. Though user does not have permission to view the blog, it is listed in asset publisher for this user.
7. Now click on the title in asset publisher, asset publisher shows nothing but throws PrincipalException at back-end due to user not having permission to view it.

But instead of throwing error later, it should not list in the asset publisher it self for that particular user.

This is the default behavior of liferay and observed with rest of the assets also like document & media, wiki etc. For document & media it shows title of file in Asset publisher on click of the link.

I am wondering if this can be counted as a bug or if any one have workaround for this?

Answer 1

After some research, I found that there is one "enable permission" configuration option in configuration mode of Asset publisher. if we enable it then it won't show the entries which do not have view permission to particular user.