Site Search - Liferay Learn

Enabling SSO for our Liferay Console prevents logging in with email and password

Issue After enabling SSO for our Liferay Console, we are no longer able to log in with email and password. Environment DXP 7.4 Resolution This is expected behavior, as per the Official documentation for SSO: "The first...

GitHub Token Leak Exposure

legacy

Issue GitHub Personal Access Token has been leaked in a public Docker container hosted on Docker Hub. Some of the malicious packages like testbrojct2, proxyfullscraper, proxyalhttp and proxyfullscrapers work...

Vulnerability: Robots.txt file must not be accessed and should be blocked

legacy Troubleshooting

Issue Encountered a vulnerability issue with the robots.txt file and the vulnerability test suggests preventing the robots.txt file from being accessed. Environment Liferay DXP 7.3 Liferay DXP 7.4...

HTTP Strict-Transport-Security Header in Liferay

legacy

Issue Is HTTP Strict-Transport-Security Header enabled in Liferay? Environment Liferay DXP 7.4 Resolution Liferay enables HTTP security headers such as 'http.header.secure.x.content.type.options',...

Unable to Cancel Shutdown Event

legacy Troubleshooting

Issue After scheduling a shutdown event, and trying to cancel it, you see an error: "Error:Text verification failed." When trying to cancel a shutdown event, I'm prompted to input a CAPTCHA, but there is...

A simple example and key factors to check when testing custom OAuth 2.0 applications

legacy How To

Issue You have created an OAuth 2.0 application and would like to set up the minimum configuration to be able to test it. This article provides a simple example that could be adapted to your needs....

Residual risk after limiting the usage of unsafe-eval and unsafe-inline

legacy

Issue Can the derivatives unsafe-eval and unsafe-inline be exploited? If yes, how it is done? What is the residual risk associated with this? Can Content Security Policy (CSP) be resolved by adding a reverse...

OpenID Connect Client Secret field must be filled

legacy Troubleshooting

Issue I configured an OpenID Connect Provider Connection. When I try to login using the OpenID Connect Client Name, I get an internal server error. In logs, a java exception is thrown: WARN [http...

Remove extend_session for Guest users

legacy

Issue Guest users should not be able to see the extend_session message in the browser once the session has expired. Environment Liferay DXP [7.1-7.4, Quarterly Releases] Resolution Post observing the time...

Access revoked after task assignment to another user

legacy How To

Issue Once the user assigns the task to another user, then the previous user loses access to that task and is unable to see that in the 'Assigned to my roles' tab of 'My workflow Tasks'. Steps to reproduce: 1....

Polyfill.io Vulnerability: Is Liferay affected?

legacy

Issue An attribute polyfill:true is observed in the source code of the website. Does it have anything to do with the domain 'https://polyfill.io'? Is Liferay affected by the Polyfill.js vulnerability? ...

The users imported from LDAP cannot change their password

legacy Troubleshooting

Issue The users who were imported from LDAP cannot modify their passwords from My Account. Environment All Liferay DXP environments Resolution Make sure that LDAP Export option is enabled. Ensure that the credentials...

Provide other permissions to Guest user beside just view permission

legacy

Issue Can users give permission to the guest users to use the headless API to create, update, delete, etc. for documents & media, besides just the VIEW permission? Environment Liferay DXP 7.4 Resolution These...

The Impersonation Attempt Fails Without Errors in the Logs or UI

legacy Troubleshooting

Issue Admin users are unable to impersonate other users. When attempting to impersonate, a new tab opens, but it remains on the original user. Impersonation attempts fail, the `doAsUserId?` is missing from...

Enable/Disable Multi-Factor Authentication

legacy How To

Issue If there is any problem related with the way two-factor is working or do you simply want to deactivate it for some reason. Environment Liferay DXP 7.4 2023 Q1 - 2023 Q4 2024 Q1 Resolution There are two...

Vulnerability on spring-web

legacy

Issue The security scanner flagged the Liferay with the security vulnerability due to the JAR containing the vulnerable classes, reported here CVE-2016-1000027. Environment Liferay DXP 7.4 Resolution It's been...

CVE-2013-3587- enable of HTTP compression

legacy Troubleshooting

Issue Security vulnerability CVE-2013-3587 details a breach attack that is possible with the enable of HTTP compression and Deflate. Steps to see the behvaior: Navigate to any of the pages on the Liferay server....

Can you add a theme or fragments to action pages?

legacy Troubleshooting

Issue How do I add fragments to action pages like /c/portal/update_password and /c/portal/update_reminder_query? Our theme reverts on utility/action pages /c/ When a user is taken to the...

Is Liferay vulnerable to CVE-2023-50164?

legacy

Issue After running a scan, we received an alert about a possible vulnerability in Liferay. We want to confirm if we are vulnerable to CVE-2023-50164. Environment All environments. Resolution Liferay is not...

Deprecation of Liferay Sync

legacy

Issue I'd like to inquire about the support for Liferay 7.4 in the Liferay Sync. Currently, the Compatibility Matrix only lists support for Liferay DXP 7.3. Environment Liferay DXP 7.4+ Resolution Liferay Sync got...

Search Results