Issue
-
When users upload a file to a restricted DDL, the file does not inherit its permission, so guest users can view the file via a link even though the DDL is not visible to them.
-
Steps to reproduce:
1. Start a clean instance
2. Navigate to Contents and Data > Dynamic Data Lists.
3. Add a new data definition with a text and a Documents and Media field.
4. Create a new dynamic data list based on this definition.
5. Open the permissions of the list, and make sure Guest View permission is not ticked (it shouldn't be, but just to make sure).
6. Add a record to the list, and the DM field uploads a file from your system.
Observed Behavior: The file is uploaded to Documents & media with a Guest View permission without the user's knowledge
Expected Behavior: A warning message shows, alerting the user to the possible permission issue
Environment
- Liferay DXP 7.2
- Liferay DXP 7.3
- Liferay DXP 7.4
Resolution
- The observed behavior is a known concern of DXP that LPS-156368 will address.
Additional Information
- If a hotfix is required, please create a support ticket requesting the hotfix by attaching the patch details.
- Installing Fix Packs and Hotfixes on Liferay DXP will guide you to install the Fixpack/Hotfix in your environment.