daledotshan/liferay-portal — pull request #111 by zxdgoal (2014-10-13 05:33:06+00:00)
Title: LPS 50662 Company admin is able to edit users on other instances.

The changes affects the codes in line 1023-1025 :

if (isCompanyAdminImpl(companyId)) {
return true;
}

The companyid should be the one of company where the resource is, rather than the one of company of the user who performing the action.

So in the original logic, the method will return TRUE as long as the user who performing actions is the admin of its own company

line 991: long companyId = user.getCompanyId();

So the company admin is able to edit users on other instances.

Now after the changes, the companyId is changed to the one of company of resource not the user.