PortletURL incorrectly created for secure resource

• Type: Bug
• Status: Verified
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 6.0.6 GA, 6.1.0 CE RC1
• Fix Version/s: None
• Component/s: Tools, Tools > Portal Taglibs
• Labels: None
• Environment: Tomcat 6.0.32, Windows 7, SQL 2008, MVCPortlet
• Fix Priority: 3
• Liferay Contributor's Agreement:
  Accept
• Similar Issues: Show 5 results ; ;

  LPS-3523	When setting secure on a PortletUrl on a page that has a layoutFriendlyURL, the url is created without https
  LPS-28411	PortletURL javascript
  LPS-22161	Creating PortletURLs in PHP causes in exceptions
  LPS-5645	Security Algorithm 6 does not create all necessary Resource Actions
  LPS-3539	Unable to create a javascript PortletURL object in a NOT logged session.

Defining a renderURL thus:

<liferay-portlet:renderURL varImpl="myURL" secure="true">
<liferay-portlet:param name="jspPage" value="/myPage.jsp"/>
</liferay-portlet:renderURL>

Were the server is currently running in an unsecure fashion, i.e. http://mydomain.com:8080/
Incorrectly results in a URL of https://mydomain.com:8080/...

Note the port number, this should have been changed to 8443 for my instance.

The issue occurs because in PortletURLImpl in the generateToString method, there is the following code at line 750:

if (layout != null) {
_layoutFriendlyURL = GetterUtil.getString(
PortalUtil.getLayoutFriendlyURL(layout, themeDisplay));

if (_secure)

{ _layoutFriendlyURL = HttpUtil.protocolize( _layoutFriendlyURL, true); }

}

HttpUtil.protocolize does not update the port number to the correct port.

[Corne]

The problem is how to retrieve this port number in a generic (Tomcat/Jboss) way
http://stackoverflow.com/questions/1233871/tomcat-how-to-get-the-secure-port-number-in-java

[Corne]

HttpImpl:

public String protocolize(String url, boolean secure) {
if (secure) {
if (url.startsWith(Http.HTTP_WITH_SLASH))

{ return StringUtil.replace( url, Http.HTTP_WITH_SLASH, Http.HTTPS_WITH_SLASH); }

}
else {
if (url.startsWith(Http.HTTPS_WITH_SLASH))

{ return StringUtil.replace( url, Http.HTTPS_WITH_SLASH, Http.HTTP_WITH_SLASH); }

}

return url;
}

[Corne]

This issue is a backlog candidate for the 100 PaperCuts program. Please consider participating! See http://liferay.com/community/100-papercuts

[Corne]

This issue is currently being addressed in Sprint 4 of the 100 PaperCuts program. Please see http://liferay.com/community/100-papercuts

[Corne]

I am a bit uncertain on the behaviour, please test well.
http://www.liferay.com/community/forums/-/message_boards/view_message/8612004

[Cynthia Wilburn]

Richard - Was the patch Corne provided a solution to the reported issue? If so, can you "accept contribution" in the workflow for us so it gets assigned to an engineer and tested? Thanks for your help!

[Richard Gibson]

This is on my list of items to test, I hope to have time later this week.

[Richard Gibson]

Please note, the original issue can only be reproduced when Liferay is running multiple instance and you access an instance that is not Localhost.

[Richard Gibson]

The supplied solution does NOT fix the problem.

Firstly:
url.replaceAll(StringPool.COLON + port, StringPool.BLANK);
does nothing, it should be:
url=url.replaceAll(StringPool.COLON + port, StringPool.BLANK);
i.e. assign back to the url variable

If the above change is made, you end up with a URL such as:
http://myhost.com/home:8443

This is incorrect, it should be:
http://myhost.com:8443/home

[Richard Gibson]

See previous comments

[Edward Gonzales]

Hello everyone! We are in the process of removing component "Liferay TagLib" from LPS issues that contain more than one component. For issues that only have "Liferay TagLib", we plan to move to them to "Tools > Portal Taglibs". In the end, "Liferay TagLib" will be deprecated. Please make the necessary adjustments to your filters. Thanks!