[gatein-issues] [JBoss JIRA] Closed: (GTNPORTAL-1137) Permission settings in application registry not preventing unauthorized access

Permission settings in application registry not preventing unauthorized access ------------------------------------------------------------------------------ Key: GTNPORTAL-1137 URL: https://jira.jboss.org/browse/GTNPORTAL-1137 Project: GateIn Portal Issue Type: Bug Security Level: Public(Everyone can see) Reporter: Matt Wringe Assignee: Khoi Nguyen Fix For: 3.1.0-GA Attachments: GTNPORTAL-1137.patch Original Estimate: 6 hours Remaining Estimate: 6 hours In the application registry, it possible to set access permission for portlets and gadgets, but this doesn't seem to work. I can change the permission of a portlet and still have an unauthorized user view its content. It does seem to prevent a user from viewing a gadget as a portlet on the dashboard page, but they can still add the gadget as a gadget to the dashboard page. Steps to reproduce: 1) log in as root 2) import a portlet through the application registry 3) set the premissions for the portlet 4) add the portlet to a page 5) logout and access the page 6) the unauthorized user can view the portlet expected results: the user shouldn't be able to see the portlet.