Site Search - Liferay Learn

"Content security policy" header is not available in the application response

Issue The "Content security policy" header is not available in the application response. How to add or enable the CSP? Environment Liferay DXP 7.3 Resolution Liferay doesn't directly support the CSP as there are no...

Version of spring-** jars after installing a hotfix

legacy

Issue To address the Spring4Shell vulnerabilities, the patched version of spring-beans.jar should be in its manifest file after the hotfix installation, is spring-webmvc.jar included in this? Environment Liferay...

Guest users are able to access an endpoint if PortalSessionAuthVerifier is enabled

legacy Troubleshooting

Issue We have followed this How-To article: How to add security, authentication to my REST service? (Section 5.1), but guest users are still able to access our endpoint from a browser. If we enable...

log4j-core-2.13.3.jar exists inside the fix pack

legacy Troubleshooting

Issue This article highlights the concern with the following path of log4j lower version jars. {liferay_home}/patching-tool/patches/liferay-fix-pack-dxp-16-7210.zip!binaries/MODULES_BASE_PATH/marketplace/Liferay...

Password reminder answers are not masked

legacy Troubleshooting

Issue As Liferay DXP does not hide password reminder answers, attackers can capture user's password reminder answers through man-in-the-middle or shoulder surfing attacks. Environment Liferay DXP 7.0 Liferay DXP...

New user is not being able to login properly

legacy Troubleshooting

Issue A new user (this also happens to LDAP users) is unable to log-in the first time, but seems to be able to log-in on the second attempt. Steps to reproduce: 1) Create a guest user from Create Account tab at the...

The birthday is reset to {01/01/1970} on LDAP import

legacy Troubleshooting

Issue Every time a user is logged in, the birthday is automatically updated to the default value {01-01-1970}. We configured the LDAP server in Instance Settings. Environment Liferay DXP 7.2 Liferay DXP 7.3...

Known vulnereabilities in jackson-databind-2.9.6

legacy Troubleshooting

Issue apio-architect-impl has a dependency of jackson-databind-2.9.6 which has the following known vulnerabilities: CVE-2018-19362 CVE-2018-19361 CVE-2018-19360 CVE-2018-14721 CVE-2018-14720 CVE-2018-14719...

Apache Log4j 1.x has reached its end-of-life

legacy

Issue Log4j 1.x has reached end-of-life status: https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 ...

CVE-2022-23305, CVE-2022-23307, and CVE-2017-5645

legacy Troubleshooting

Issue This article outlines the concerns of CVE-2022-23305, CVE-2022-23307, and CVE-2017-5645 vulnerabilities with respect to the Liferay DXP Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP...

javax.portlet.PortletException: java.lang.IllegalStateException: getAttribute: Session already invalidated error

legacy

Issue Why does this error gets triggered? What would be the cause? INFO [http-nio-8080-exec-2573][CustomLoginPortlet:726] url redirect = https://xxxx/group/yyyy ERROR [http-nio-8080-exec-2573][PortletServlet:112]...

Error when configuring SAML in a clustered environment for the first time

legacy Troubleshooting

Issue When configuring SAML in a clustered environment and entering the configuration Idp connection an error is shown: java.lang.RuntimeException: java.lang.NullPointerException at...

Getting mixed content on the portal

legacy Troubleshooting

Issue After enabling SSL and routing the domain, getting mixed content on the portal that is the pages in the https://www.abc.in referring the http://www.abc.in for the stylesheet, javascript, and henceforth....

Browser console error : The connection used to load resources from https://www.xxx.yyyy used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future

legacy Troubleshooting

Issue Browser console error as "The connection used to load resources from https://www.xxx.yyyy used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future. Once disabled, users will be prevented...

How to verify the current Implementation version of log4j.jar file

legacy How To

Issue We would like to verify the implementation version of a log4j.jar file, either to verify the application of an update or to assess current vulnerability. Environment DXP 7.3, DXP 7.4 Resolution You can find the...

Liferay accepts only fully signed SAML responses. Can this requirement be turned off?

legacy

Issue From a security standpoint, it's a best practice to sign the Response. However, we can switch off this requirement in our other apps. I can understand that Liferay by default requires the complete signature of...

SSO SP connection doesn't send unauthenticated users to /c/portal/login

legacy How To

Issue Once we setup a SAML SP connection, the SAML adapter doesn't recognize unauthenticated users and redirect them to /c/portal/login Environment DXP 7.4 Resolution This is intended behavior with the “Prompt Enabled”...

User is redirected to the 404 page instead of the login page when the session expires.

legacy How To

Issue The user is not prompted for login but to a 404 page when navigating in pages with restricted access if the user session expires or, if the user is not logged in and tries to access directly the url. ...

What should be done when answers to the security questions are forgotten?

legacy How To

Issue My users keep forgetting their answers to the security questions is there a way to disable this? Also is there an alternative to the forgot password option? Environment DXP 7.4 Resolution Liferay already sends a...

Does having a script in a fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in a fragment's HTML section where the code can be executed, when the fragment is opened, like <img src=x onerror="alert(document.cookie)"> Can that be a vulnerability to...

Search Results