juliocamarero/liferay-portal — pull request #1157 by topolik (2013-01-24 13:49:17+00:00)
Title: LPS-31892

Hi Julio,

core of the issue are missing permission checks when displaying Manage Page => when "cmd" parameter is not defined.

I had to fix this in render phase (EditLayoutsAction) and in resource phase (view_resources.jsp).

To fix this I needed to distinguish display page action (cmd="") from cmd=publish_to_live and refactor the code for that. But this isn't clear refactor and caused change in the permission checking logic.

Before my change, "publish_to_live" action checked for
1, Group.PUBLISH_STAGING and Layout.UPDATE actions
2, UPDATE for group of type Company/LayoutPrototype/LayoutSetPrototype/User.

I tried to activate staging on the groups (Company/LayoutPrototype/LayoutSetPrototype/User) but there is no UI for this. When I tried to manipulate URL and replace groupIds to enable staging on these groups, it end up with ConstraintViolation DB exception. So it seems that the checks were never executed in real.

So I changed it so that now md=publish_to_live only checks:
1, Group.PUBLISH_STAGING and Layout.UPDATE actions

I also changed permission checking logic in EditLayoutsAction from allowing to denying. Boolean hasPermission was initially set to "true" and changed to false only in some cases, which is a bad behavior from a security perspective.

I know it seems complicated, if you need any assistance please call me.

Thank you.