Ask Questions and Find Answers

hi
i use liferay 6.2, updated from 6.1.1
it's happen today's morning, some user can add admin portlet in his personal dashboard, and he used it. 
i want to know, how to query from db to know who already added the portlet in their dashboard.and how can i change the value to make them cannot use it.and
i checked the both portlet's liferay-portlet.xml and portlet.xml. the role-mapper only for manager, and he is not and never was.
how it happen, anything i can trace?
thank you.

There's an "add to page" permission that the person in question shouldn't have (for this portlet), unless they have elevated permissions. On top of that, without any elevated permissions, they shouldn't have permissions on any data that could be configured with that portlet anyway.
To figure out which page it's on won't be very simple. Disclaimer upfront: A better way would be to go through the API. Pages are called Layouts, and you can enumerate all Layouts, and check the portlets on them. That being said: You'll need to identify the portletId for the portlet in question, and most likely you'll be able to find it in some xml field in the Layout table as well. Just NEVER write to the database, it's barely ok to quickly filter/read to get an idea of what's going on, but writing to the db is out-of-question)