Web Content Permission Change Starting With 6.2 SP9

When updating to Liferay Portal 6.2 SP9 or a fix pack that that contains LPS-40597, web content assets that guest users used to be able to view will not be displayed.

Steps to reproduce:
Behavior prior to 6.2 SP9

1. Set journal.article.view.permission.check.enabled=true in portal-ext.properties.
2. Start a clean (no patches or customizations) instance of Liferay Portal 6.2 SP7.
3. Add a page to the site and add a web content portlet to that page.
4. Configure the web content portlet so that Guests have view permissions.
   1. Click the Wrench icon → Configuration.
   2. Click the Permissions tab.
   3. Verify that the View checkbox next to Guest is checked.
   4. Click the Save button.
   5. Close the iframe.
5. Add one web content to the web content portlet.
6. Visit the site as a guest user, the web content shows.
7. Shut down the application server.
8. Start the application server with Liferay Portal 6.2 SP9 deployed and verify that it is connected with the same database as the steps above.
9. Visit the site as guest user. Users will notice that the web content article does not display. Guest user does not have permissions to view that asset.

Resolution

Technical explanations

The root cause of this issue is in this commit for LPS-40597. In the journal.xml file, view permissions are added to the guest and site member roles. View permissions have been removed for the <guest-unsupported> tag.

Next, the permission check mechanism has been changed:
Before LPS-40597, the portal checked whether the guest (or site member) does not view permission. If the user did not have view permission, web content articles are not displayed. If undefined, the user will see the web content.
After LPS-40597, the portal checked whether guest (or site member) do have view permission. If the user does have view permission, web content articles are displayed. If undefined, he will not see the web content.

This is reflected in the Control Panel → Roles.

1. Click Admin → Control Panel.
2. Click Roles.
3. Click Actions → Define Permissions next to Guest.
4. On the left side menu, Click Site Administration → Content → Web Content.

As you can see in the screenshot below, in Liferay Portal 6.2 SP7, there is no view permission under Resource Permissions.

In Liferay Portal 6.2 SP9 and higher, there is a view permission setting under Resource Permissions. The view permission is unchecked.

With this new permission checking mechanism, guest or site member roles do not have view resource permission, so guest users cannot view web content even though the web content portlet is set to be viewable by guest.

The solution is to set this view permission under resource permissions to guest and site member.