The public function /c/journal/get_articles seems to list articles disregarding their permissions settings. So by using this function I can get articles that I'm not authorized to view according to the permission settings. If I use the /c/journal/view_article_content to view the same article as I got in get_articles I get a permissions denied. Seems to me like the get_articles function do not check permission of the articles returned. Can anybody share some light on this, should I create a bug?
I created a bug
http://issues.liferay.com/browse/LPS-6611
