Site Search - Liferay Learn

[T003] Open redirect in /c/document_library/find_folder with DNS rebinding vulnerability

Issue Medium threat found during the performance testing: [T003] Open redirect in /c/document_library/find_folder with DNS rebinding Environment Liferay Quarterly release Resolution The reported concern has been...

Enabling SSO for our Liferay Console prevents logging in with email and password

legacy

Issue After enabling SSO for our Liferay Console, we are no longer able to log in with email and password. Environment DXP 7.4 Resolution This is expected behavior, as per the Official documentation for SSO: "The first...

Multi-Factor Authentication via SMS

legacy

Issue We want to set up MFA via SMS without using any external Apps. Is this possible with Liferay out-of-the-box? Environment Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Resolution MFA by SMS is not...

Unable to Cancel Shutdown Event

legacy Troubleshooting

Issue After scheduling a shutdown event, and trying to cancel it, you see an error: "Error:Text verification failed." When trying to cancel a shutdown event, I'm prompted to input a CAPTCHA, but there is...

Obfuscating property values and rendering them as asterisks(*****) in the Control Panel.

legacy How To

Issue Certain property values need to be hidden in the Control Panel. Environment DXP 7.4 Resolution To obfuscate the value of a portal property and have it appear as a string of asterisks (****) in the Control Panel,...

Vulnerable JavaScript dependency Bootstrap-select 1.12.4

legacy

Issue The version of bootstrap-select 1.12.4 is vulnerable to attacks. To overcome this, bootstrap-select should be upgraded to a non-vulnerable version. Environment Liferay DXP 7.3 Resolution Liferay does not...

Email are not sent from Liferay when Office365 is used as the server

legacy Troubleshooting

Issue Emails are not sent out from Liferay In the log, we see the following error: liferay[liferay-7] [dxp] ERROR [liferay/mail-6][MailEngine:74] Unable to send message: 535 5.7.139 Authentication unsuccessful, the...

Is there a way to bypass CAPTCHA without having to disable it?

legacy How To

Issue We will do some Automation tests in our QA environment and would like to know if it is possible to bypass CAPTCHA using configuration settings without having to disable it. Environment Liferay DXP 7.4...

"Text verification failed" Captcha error

legacy Troubleshooting

Issue We are trying to use the Reset Password functionality, but every time we enter the captcha text correctly, we always get an error saying: "Text verification failed". We noticed this same behavior on other...

Vulnerability in Apache Tomcat (CVE-2023-46589)

legacy Troubleshooting

Issue This security vulnerability (CVE-2023-46589) has been reported, and it is fixed in Tomcat 9.0.83. However, our current Liferay DXP 7.4 update 67 has a 9.0.71 Tomcat version. Environment Liferay DXP 7.4...

Liferay 6.2 EE 173 and CVE-2024-25145

legacy

Issue We have found the following article CVE-2024-25145 Stored XSS with search results if highlighting is disabled, however it does not specify whether Liferay 6.2 EE 173 is affected or not. Environment Liferay 6.2 EE...

Can SAML be used to send an attribute that can be used to assign site roles?

legacy

Issue Currently, SAML is not designed to be utilized to send an attribute that can be used to assign site roles. Environment Quarterly Releases Resolution This is an ongoing task, LPD-6336, for Liferay. Liferay is...

OpenID Connect Error - "Signed JWT rejected" with CAS

legacy Troubleshooting

Issue When configuring authentication using OpenID Connect, login fails and the following error is reported: Unable to validate tokens: Signed JWT rejected: Another algorithm expected, or no matching key(s) found...

SAML Sessions remain Active despite Logout in Liferay

legacy Troubleshooting

Issue We have integrated SAML with our Liferay configuration. We have noticed that after a User logs out, their session remains active in Liferay. Environment Liferay DXP 7.3 Resolution This issue may occur if the...

p_auth token missing from GET request

legacy

Issue After enabling CSRF Tokens, a p_auth token is appended to URLs, as expected. However, we noticed that if we manually remove this from the end of a URL and hit enter, we are still able to access the page,...

How to enable cookies and the banner, consent panel

legacy How To

Issue How to enable the cookie preference handling as well as the configuration options for both the banner and the consent panel. Environment Liferay DXP 7.4 Resolution This feature was introduced in the Liferay...

After enabling LDAP authentication, administrator users who do not exist in LDAP can log in

legacy

Issue We have enabled LDAP authentication, checking it as required and we have unchecked Ignore User Search Filter for Authentication. With this configuration applied the administrator users can login even if...

Setting sameSite attribute in Cookie for header response on JBoss EAP 7.2

legacy How To

Issue How to add the sameSite attribute as 'Strict' on the cookies JSESSIONID,COOKIE_SUPPORT,GUEST_LANGUAGE_ID on JBoss EAP 7.2 Environment Liferay DXP 7.4 JBoss EAP 7.2 Resolution In JBoss, navigate...

Requests to Liferay with an invalid HOST request HTTP header returns the default site

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue Requests to Liferay with an invalid HOST request...

Access-control-allow-origin CORS Header not honoring System setting Configuration

legacy

Issue When configuring CORS headers in System Settings we are seeing that access-control-allow-origin header doesn't always have the configured value. Environment Liferay DXP 7.4 Resolution According to the...

Search Results