Site Search - Liferay Learn

How to monitor who and what deleted pages or any data

Issue I would like to check who and what deleted pages or data from the Liferay system. Environment Liferay DXP 7.3 Liferay DXP 7.4 Resolution There are two ways of checking who and what deleted data: 1. From the UI...

User did not provide a valid CSRF token Error

Troubleshooting

Issue Portlet Action requests intermittently returning a 403 error code. In the logs the following error message regarding invalid CSRF token gets printed whenever the 403 error is thrown. "User [user_id] did not provide...

Login URL Parameters Reported as Security Threat

legacy Troubleshooting

Issue Vulnerability Assessment and Penetration Testing (VAPT) reports the parameters passed in the login request as a security threat. How can these parameters be removed or mitigated? Environment Liferay DXP 7.4+...

Can Liferay pass User Roles to the Service Provider?

legacy

Issue In a SAML configuration where Liferay acts as the Identity Provider, is Liferay able to pass its User Roles to the Service Provider? Environment Liferay 7.4 Resolution Yes, it is possible. Liferay will send...

XSS Vulnerability present when using Web Content Article's source code

Troubleshooting

Issue We've observed a XSS Vulnerability present when using Web Content Article's source code. This vulnerability appears to be present when involving the deployment of a payload via the source code. Steps to...

SAML - Can you end the Identity Provider's session when the Service Provider's session times out?

legacy Troubleshooting

Issue We have Liferay configured as a SAML Service Provider (SP), and we use third-party software as the Identity Provider (IdP) Our IdP is used for multiple applications, so its session timeout is set for a...

Is integration of mTLS possible in Liferay?

legacy How To

Issue We are required to use mTLS (Mutual Transport Layer Security) for certain requests Is it possible to integrate mTLS with Liferay? Environment DXP 7.4 Quarterly Releases Resolution Yes, it is possible to...

Is Liferay vulnerable to CVE-2024-38819: SpringFramework (spring-core-5.3.39)?

legacy

Issue CVE-2024-38819: Path traversal vulnerability in functional web frameworks (2nd report) is related to the usage of WebMvc.jar. Is Liferay vulnerable to this vulnerability? Environment Liferay DXP 7.3...

"http://localhost:8080/o/oauth2/authorize" URL redirect to the Login Page

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue When accessing the OAuth2 authorization URL...

Getting BadPaddingException errors in the logs after an upgrade

legacy Troubleshooting

Issue After upgrading Liferay DXP, javax.crypto.BadPaddingException errors appear in the logs when using 'Auto Login' feature ('Remember me'). Example error message: ERROR [AutoLoginFilter:247] Current URL /home...

SAML Logout Issues: Multiple Login Entries and Optimistic Locking Exceptions

legacy Troubleshooting

Issue When a user logs out after authenticating via SAML, multiple login entries might be recorded in the audit logs. This can lead to HibernateOptimisticLockingException errors, particularly during...

In SAML setup user is not getting login in the SP and receiving warning on the UI

legacy Troubleshooting

Issue After setting up the SAML process, the user tries to log in receiving the warning below and not being logged in. Environment Liferay 2023.Q4.0 Resolution If users are setting up an identity provider as...

SAML Authentication Error: "This message decoder only supports the HTTP POST method

legacy Troubleshooting

Issue The following SAML errors appear in the Liferay logs: ERROR [http-nio-8080-exec-5][BaseSamlStrutsAction:53] org.opensaml.messaging.decoder.MessageDecodingException: This message decoder only supports the...

Unexpected SAML calls: com.liferay.saml.internal.servlet.filter.SpSessionTerminationSamlPortalFilter.doProcessFilter

legacy Troubleshooting

Issue When navigating through the portal with SAML disabled, there are a few SAML-related filters that are still being processed, leading to database calls and causing slower performance. at...

CORS request is failing

legacy Troubleshooting

Issue If the user allows any origin (Access-Control-Allow-Origin: *) to access the resource, the CORS request fails. Steps to reproduce: 1. Start Liferay DXP 7.4 U90 2. Navigate to Control Panel > Instance...

LIFERAY.HEADLESS.DELIVERY scope missing or delayed in OAuth 2 applications

legacy Troubleshooting

Issue The LIFERAY.HEADLESS.DELIVERY scope is missing or delayed in appearing when creating or managing OAuth 2 applications. The issue can occur intermittently, with the scope sometimes appearing after a delay of...

Is it possible to offer both SAML and OIDC as SSO options?

legacy How To

Issue Both SAML and OpenID Connect(OIDC) can be configured on the same Liferay instance. However, the option to authenticate using OIDC is missing whenever SAML is enabled. Is it possible for a user to select either SSO...

Audit Events filtered by date/time are not being exported accurately

legacy Troubleshooting

Issue When using using the Audit Export Feature, filters for date and time are not applied accurately in the resulting CSV file. The exported file may not include entries explicitly requested by the filter. For...

I want to skip OpenID Connect provider selector at sign in if there is only one provider

legacy Troubleshooting

Issue We want to bypass the client selection screen because there is only one OpenID Client to choose. Environment Quarterly Releases Resolution There is a Feature Request opened for this which is currently under...

Vulnerabilities for spring-web and spring-core

legacy

Issue Vulnerabilities remain unresolved in spring-web and spring-core, even after a fix was applied to spring-context. For spring-web: Vulnerable component: org.springframework:spring-web:5.3.39 For spring-core:...

Is Session Prediction Possible in Liferay

legacy

Issue Is it possible an attacker could predict the JSESSIONID and gain unauthorized access, referencing an example from a 'Session Prediction' article? Explanation of Issue Using the "Catalog" Page in Postman: If a...

Enabling both Liferay's default login and SAML login so that users can use either option

legacy How To

Issue I would like to configure and enable SAML login while also having Liferay's default login available to users so that they can have two options for logging in. Environment DXP 7.4+ Quarterly Release Resolution...

Resolving 401 Errors When Using Authorization Bearer Tokens in RestBuilder APIs

legacy Troubleshooting

Issue When making calls to a REST API service created with RestBuilder that includes the Authorization Bearer token header, the responses often return a 401 Unauthorized status. However, when the same service is...

High CPU and memory use with stacktraces associated to password encryption

legacy Troubleshooting

Issue The environment starts using a large amount of CPU and also memory. Reviewing thread dumps taking during that time, there are many threads associated to PBKDF2PasswordEncryptor.encrypt, such as:...

Unable to get OpenID Connect's link to work after upgrading to a Quarterly Release

legacy Troubleshooting

Issue After upgrading to Quarterly Release 2023.Q3.4 from DXP 7.3, we've found that OpenID Connect is no longer working. The button is no longer populating within the UI even after enabling it using this article:...

SCIM API is not working as expected to link existing users to SCIM Client

legacy

Issue I'm unable to use the PUT API to update users as linked to the SCIM Client. I'm not able to add new users and then update them using the PUT API linking them to the SCIM client. Environment 2024.Q1+ Resolution...

Password for LDAP and Liferay users should not expire

legacy Troubleshooting

Issue After integrating Liferay with the LDAP server for users, the passwords for the users are expiring after some time and are required to be reset again. Is there any way for the passwords to never...

Multi-Factor Authentication via SMS

legacy

Issue We want to set up MFA via SMS without using any external Apps. Is this possible with Liferay out-of-the-box? Environment Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Resolution MFA by SMS is not...

Vulnerability: Robots.txt file must not be accessed and should be blocked

legacy Troubleshooting

Issue Encountered a vulnerability issue with the robots.txt file and the vulnerability test suggests preventing the robots.txt file from being accessed. Environment Liferay DXP 7.3 Liferay DXP 7.4...

GitHub Token Leak Exposure

legacy

Issue GitHub Personal Access Token has been leaked in a public Docker container hosted on Docker Hub. Some of the malicious packages like testbrojct2, proxyfullscraper, proxyalhttp and proxyfullscrapers work...

Remove extend_session for Guest users

legacy

Issue Guest users should not be able to see the extend_session message in the browser once the session has expired. Environment Liferay DXP [7.1-7.4, Quarterly Releases] Resolution Post observing the time...

Access revoked after task assignment to another user

legacy How To

Issue Once the user assigns the task to another user, then the previous user loses access to that task and is unable to see that in the 'Assigned to my roles' tab of 'My workflow Tasks'. Steps to reproduce: 1....

CVE-2013-3587- enable of HTTP compression

legacy Troubleshooting

Issue Security vulnerability CVE-2013-3587 details a breach attack that is possible with the enable of HTTP compression and Deflate. Steps to see the behvaior: Navigate to any of the pages on the Liferay server....

Provide other permissions to Guest user beside just view permission

legacy

Issue Can users give permission to the guest users to use the headless API to create, update, delete, etc. for documents & media, besides just the VIEW permission? Environment Liferay DXP 7.4 Resolution These...

Can you add a theme or fragments to action pages?

legacy Troubleshooting

Issue How do I add fragments to action pages like /c/portal/update_password and /c/portal/update_reminder_query? Our theme reverts on utility/action pages /c/ When a user is taken to the...

Polyfill.io Vulnerability: Is Liferay affected?

legacy

Issue An attribute polyfill:true is observed in the source code of the website. Does it have anything to do with the domain 'https://polyfill.io'? Is Liferay affected by the Polyfill.js vulnerability? ...

The Impersonation Attempt Fails Without Errors in the Logs or UI

legacy Troubleshooting

Issue Admin users are unable to impersonate other users. When attempting to impersonate, a new tab opens, but it remains on the original user. Impersonation attempts fail, the `doAsUserId?` is missing from...

Redirecting to login page when authenticated via SAML returns a 500 error

legacy Troubleshooting

Issue Navigating to to the login page /c/portal/login on the SP throws a 500 error when already logged in through SAML. Environment DXP 7.3 DXP 7.4 Resolution This is a known issue affecting DXP 7.4 U80 and lower and...

Vulnerability on spring-web

legacy

Issue The security scanner flagged the Liferay with the security vulnerability due to the JAR containing the vulnerable classes, reported here CVE-2016-1000027. Environment Liferay DXP 7.4 Resolution It's been...

Enable/Disable Multi-Factor Authentication

legacy How To

Issue If there is any problem related with the way two-factor is working or do you simply want to deactivate it for some reason. Environment Liferay DXP 7.4 2023 Q1 - 2023 Q4 2024 Q1 Resolution There are two...

Search Results