Issue
- Regardless of who created the page, the Admin user or any site owner role needs to be able to control its deletion on the live site.
-
Steps to reproduce:
1. Startup Liferay DXP 7.2
2. Enable remote staging and create a public page (Test Page) on the local site.
3. Publish page from staging to live
4. Go to the live site, and check for the same published page
5. In page navigation, click the three dots beside the page name
Observed Behavior: You'll see a Delete option, which will allow you to remove the page from the 'remote/live' site.
Expected Behavior: Pages should not be allowed to be deleted from the Live Site.
Environment
- Liferay DXP 7.0
- Liferay DXP 7.1
- Liferay DXP 7.2
Resolution
-
Allowing deletion in a Live environment is an intentional feature of DXP. This was created with the idea that it could be useful in some cases to be able to delete pages even in a live environment (because there is no convenient method to do it otherwise).
-
This is expected portal behavior, as the Owner has all permissions to the object created by that Owner by default. For all owner-type roles in Liferay, such as Organization Owner and Site Owner, this is the default functionality. For example, since the Site Editor user created the Page, they maintain all permissions associated with that page as the page's owner, regardless of their other Roles. This is because the permissioning system just checks to see if any of the user's roles permit access, and the Owner role does.
-
As a result, in the Live environment, there is no OOTB functionality to disable the delete option.
Additional Information
- Workaround: User can attempt customizing by editing the sites.xml file in the {Liferay-Home}\tomcat-9.0.33\webapps\ROOT\WEB-INF\lib\portal-impl.jar\resource-actions.
- We have a channel called 'Global Service Team' that could further assist with the code-level implementation or any development ideas.