Site Search - Liferay Learn

Redirecting to login page when authenticated via SAML returns a 500 error

Issue Navigating to to the login page /c/portal/login on the SP throws a 500 error when already logged in through SAML. Environment DXP 7.3 DXP 7.4 Resolution This is a known issue affecting DXP 7.4 U80 and lower and...

GDPR-compliant 3rd party cookie handling in 7.3

legacy

Issue Can you backport GDPR-compliant 3rd party cookie handling to 7.3 SP3? Environment The feature got implemented in DXP 7.4.13-u66. Backporting this feature to 7.3 is not feasible. Resolution There are 3 options...

A simple example and key factors to check when testing custom OAuth 2.0 applications

legacy How To

Issue You have created an OAuth 2.0 application and would like to set up the minimum configuration to be able to test it. This article provides a simple example that could be adapted to your needs....

OpenID Connect Client Secret field must be filled

legacy Troubleshooting

Issue I configured an OpenID Connect Provider Connection. When I try to login using the OpenID Connect Client Name, I get an internal server error. In logs, a java exception is thrown: WARN [http...

Residual risk after limiting the usage of unsafe-eval and unsafe-inline

legacy

Issue Can the derivatives unsafe-eval and unsafe-inline be exploited? If yes, how it is done? What is the residual risk associated with this? Can Content Security Policy (CSP) be resolved by adding a reverse...

Remove extend_session for Guest users

legacy

Issue Guest users should not be able to see the extend_session message in the browser once the session has expired. Environment Liferay DXP [7.1-7.4, Quarterly Releases] Resolution Post observing the time...

Access revoked after task assignment to another user

legacy How To

Issue Once the user assigns the task to another user, then the previous user loses access to that task and is unable to see that in the 'Assigned to my roles' tab of 'My workflow Tasks'. Steps to reproduce: 1....

CVE-2013-3587- enable of HTTP compression

legacy Troubleshooting

Issue Security vulnerability CVE-2013-3587 details a breach attack that is possible with the enable of HTTP compression and Deflate. Steps to see the behvaior: Navigate to any of the pages on the Liferay server....

How to Disable CAPTCHA on Server Admin Pages

legacy How To

Issue How do you disable CAPTCHA on pages? Site Administration pages like the Gogo Shell now have a CAPTCHA verification. How do you disable CAPTCHA on pages? Adding “-1” (Never Check), doesn’t work....

Security Issue: CVE-2024-28752 - Apache CXF

legacy

Issue Security vulnerability CVE-2024-28752 details a SSRF vulnerability with the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3, and 3.5.8, which would allow an attacker to perform SSRF style attacks...

LDAP import PermissionChecker not initialized

legacy Troubleshooting

Issue When importing users by Groups and enabling ‘Creating Roles on Import’, the roles and groups will be created/imported, but the users are not imported. Error reads PermissionChecker not initialized...

User enumeration attack via response time

legacy Troubleshooting

Issue It is possible to determine if an email address is valid or not (i.e., user enumeration) by comparing the request's response time. This can be done by checking the browser's network tab and comparing...

How do we Toggle Requirement for Strangers to Verify their Email Address

legacy How To

Issue How do we toggle the requirement for strangers to verify their email address Environment DXP 7.4 Resolution This setting can be toggled by going to: Instance Settings > User Authentication. From here, you can...

Checking for vulnerability to CVE-2022-42889

legacy Troubleshooting

Issue Is our Liferay instance vulnerable to CVE-2022-42889? Environment DXP 7.4, DXP 7.3, DXP 7.2, DXP 7.1, DXP 7.0 Resolution Look for commons-text in ${liferay.home}/license/versions.html, if you do not find it, you...

How to reduce difficulty on captcha for Liferay DXP 7.2

legacy Troubleshooting

Issue The captcha generated in the login is unreadable, even for humans. Environment Liferay DXP 7.2 Resolution Go to System Settings > Security Tools. Find and delete the following properties: ...

CVE-2023-33950

legacy Troubleshooting

Issue We would like to determine whether Liferay is vulnerable to CVE-2023-33950 The CVE claims that Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allow regular...

Security Issue Concerning Google Guava Versions 1.0 to 32

legacy How To

Issue There is a present vulnerability with Google Guava that affects the versions from 1.0 to 31.1. Liferay is currently bundled with Guava. It has been reported that...

How to test for vulnerabilitity to CVE-2020-7961

legacy How To

Issue We would like to determine if we are vulnerable to CVE-2020-7961. Environment DXP 7.3, DXP 7.2, DXP 7.1, DXP 7.0 Resolution The steps to test for vulnerability to CVE-2020-7961 are as follows: 1. Start your...

Relay state exceeds 80 bytes

legacy Troubleshooting

Issue After configuring SAML, I see Relay state exceeds 80 bytes WARN messages in the logs. How can I prevent the transmission of relay states larger than 80 bytes? Environment DXP 7.X Resolution This issue was...

CVE-2020-28885 and CVE-2020-28884

legacy

Issue We would like to know about Liferay's vulnerability to CVE-2020-28885 and CVE-2020-28884. The CVE's claim that it is a vulnerability for an Administrator User to be able to inject commands through the Gogo Shell...

Search Results