Audit follow-up: RoleAjax permission save can report success after rollback

Parent epic: #36004

Finding

RoleAjax.saveRolePermission appears to open an explicit transaction, and on failure logs and rolls back without rethrowing. Control can continue to the trailing success path, so the DWR caller may receive a successful empty response even though permission changes were rolled back.

Report reference: dotCMS/src/main/java/com/dotmarketing/business/ajax/RoleAjax.java:803-906

Potential impact

Admins may believe permissions were applied when they were not, creating silent over- or under-privileged access risk.

Suggested validation

Reproduce by forcing a permission-save failure inside the transaction and confirming the DWR/browser behavior after rollback.

Possible fix

Rethrow from the catch block, move the success log inside the successful try path, and consider replacing manual transaction handling with @WrapInTransaction if appropriate.

Caveat

This was AI-found by Claude from .scratch/audit/REPORT.md. Please perform secondary validation of correctness, severity, and value before actioning.

Start in dotCMS/src/main/java/com/dotmarketing/business/ajax/RoleAjax.java at RoleAjax.saveRolePermission, lines 803-906, and trace the explicit transaction, catch/rollback path, and trailing success response. Reproduce a permission-save failure and observe the DWR/browser behavior after rollback. Done means the finding is validated and the caller no longer receives a success response for rolled-back changes.