liferay/liferay-portal — pull request #302 by victormirandabeltran (2013-01-09 14:24:26+00:00)
Title: LPS-32028 - Add page permission control in JSP

This ticket is caused because there is a java permission checking that is not done in the JSP file.

Because of this problem, the page enables sending the request to the server. Then, the server checks the permission and returns a null response, causing an error in the client.

All the behabiour is reported in jira ticket.

The solution I propose is to add permission check in jsp file. Maybe it would be interesting to include logging in the java class.

The permission control in java side is in the class com.liferay.portlet.layoutsadmin.action.UpdateLayoutAction.java (line 90):

if ((layout != null) &&
!LayoutPermissionUtil.contains(
permissionChecker, layout, ActionKeys.UPDATE)) {

return null;
}