Site Search - Liferay Learn

X-Xss-Protection response header is not working in DXP 7.4

Issue To enable X-Xss-Protection, add the below property in system-ext.properties http.header.secure.x.xss.protection=1; mode=block and restarted the server. But it is not working in the Liferay. Environment...

Is SELinux compatible with Liferay DXP 7.4?

legacy

Issue Is SELinux configuration compatible with Liferay DXP 7.4? Environment Liferay DXP 7.4 Running on one of the supported Operating Systems Resolution It is possible to set up SELinux to work with Liferay DXP 7.4 It is up to...

Insecure Cross Document Messaging

legacy Troubleshooting

Issue Cross Document Messaging (also known as Web Messaging) introduced the postMessage() method, with which plaintext messages can be sent cross-origin. It consists of two parameters: “message”, and...

CSP headers are not working on DXP-7.4

legacy Troubleshooting

Issue Trying to attempt to work with the CSP feature, which is present in update 90 under feature flags, but users are still experiencing issues where they are unable to edit the page and it is continuously...

High CPU utilisation while using script to login users continuously

legacy Troubleshooting

Issue Facing high CPU utilization while logging-in high number of users per minute continuously (24x7) using username-password authentication, mostly while fetching data using some scripts. Environment Liferay DXP...

Is Liferay vulnerable to CVE-2023-40371 and CVE 2023-38408?

legacy

Issue Is Liferay vulnerable to any of these vulnerabilities? Environment DXP 6.2+ Resolution No, Liferay is not vulnerable to any of these two. Neither CVE relates to any Liferay features, so they do not...

Not Found page seen instead of Login Prompt when logged out and navigating to private pages

legacy How To

Issue When not logged in, and user attempts to navigate to private page's URL, instead of being prompted to log in, a 'Not Found' page is seen instead. Environment DXP 7.4 Resolution In DXP 7.3, when users are not logged...

Users see the message "Redirecting to your identity provider" before redirecting to OKTA login screen

legacy Troubleshooting

Issue The guest user observed the message "Redirecting to your identity provider" showed up before the OKTA user login screen showed up. The behavior just happened after upgrading the environment to 7.4 Update 56. We don't...

How to protect against the vulnerabilities related to SnakeYaml in version 1.27

legacy Troubleshooting

Issue How can I mitigate vulnerability CVE-2022-38749, CVE-2022-38750, CVE-2022-38751 and CVE-2022-38752 regarding Liferay DXP? Environment Liferay Portal 6.2 EE Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2...

Vulnerability in Apache Tomcat (CVE-2023-46589)

legacy Troubleshooting

Issue This security vulnerability (CVE-2023-46589) has been reported, and it is fixed in Tomcat 9.0.83. However, our current Liferay DXP 7.4 update 67 has a 9.0.71 Tomcat version. Environment Liferay DXP 7.4...

Obfuscating property values and rendering them as asterisks(*****) in the Control Panel.

legacy How To

Issue Certain property values need to be hidden in the Control Panel. Environment DXP 7.4 Resolution To obfuscate the value of a portal property and have it appear as a string of asterisks (****) in the Control Panel,...

Liferay 6.2 EE 173 and CVE-2024-25145

legacy

Issue We have found the following article CVE-2024-25145 Stored XSS with search results if highlighting is disabled, however it does not specify whether Liferay 6.2 EE 173 is affected or not. Environment Liferay 6.2 EE...

Email are not sent from Liferay when Office365 is used as the server

legacy Troubleshooting

Issue Emails are not sent out from Liferay In the log, we see the following error: liferay[liferay-7] [dxp] ERROR [liferay/mail-6][MailEngine:74] Unable to send message: 535 5.7.139 Authentication unsuccessful, the...

OpenID Connect Error - "Signed JWT rejected" with CAS

legacy Troubleshooting

Issue When configuring authentication using OpenID Connect, login fails and the following error is reported: Unable to validate tokens: Signed JWT rejected: Another algorithm expected, or no matching key(s) found...

Is there a way to bypass CAPTCHA without having to disable it?

legacy How To

Issue We will do some Automation tests in our QA environment and would like to know if it is possible to bypass CAPTCHA using configuration settings without having to disable it. Environment Liferay DXP 7.4...

Can SAML be used to send an attribute that can be used to assign site roles?

legacy

Issue Currently, SAML is not designed to be utilized to send an attribute that can be used to assign site roles. Environment Quarterly Releases Resolution This is an ongoing task, LPD-6336, for Liferay. Liferay is...

Getting 'DuplicateSamlIdpSsoSessionException' in the Debug Logs

legacy Troubleshooting

Issue Users are facing intermittent login issues in the SAML environment; however, the below error is observed frequently in their log files: DEBUG [default task-73687][BaseSamlStrutsAction:61] null...

Security Vulnerability CVE-2023-28708

legacy How To

Issue This security vulnerability (CVE-2023-28708) has been reported, and it is fixed in Tomcat 9.0.72. However, our current Liferay DXP 7.3 SP1 has a 9.0.40 Tomcat version. Environment Liferay DXP 7.3 Resolution...

/language showing 403 forbidden url

legacy Troubleshooting

Issue When the user tries to access the URL: 'http://localhost:8080/language', even if the language page doesn't exist, it shows a 403 Forbidden error on UI instead of a 404 page not found. Logs error: ERROR...

Vulnerable JavaScript dependency Bootstrap-select 1.12.4

legacy

Issue The version of bootstrap-select 1.12.4 is vulnerable to attacks. To overcome this, bootstrap-select should be upgraded to a non-vulnerable version. Environment Liferay DXP 7.3 Resolution Liferay does not...

Search Results