Add a configuration option to allow disabling the ability to execute freemarker code for newly created DDM Templates in a System

• Type: Story
• Status: Closed
• Priority: Minor
• Resolution: Completed
• Affects Version/s: None
• Fix Version/s: Master
• Component/s: Data Engine, Fragment Administration, Widget Templates
• Labels:
  • echo-board-out
  • exclude_from_metrics
  • fc_20_07
  • no_predic
  • pt-app-security-review
• Epic Link: Configuration Option to Disable Freemarker in Fragments
• Sprint: Data_Engine_7.3_28
• Git Pull Request: https://github.com/leoadb/liferay-portal/pull/953

Intro/Context:

Liferay provides UIs (such as with the Portlet Display Template portlet and DDM Web portlet) and APIs to create templates that use the available template engines such as freemarker. However in some contexts it's not desired to enable this possibility since it provides too much power and possibilities of impacting the system through bad template code. For sensitive systems, it might be preferable to disable the creation of DDM Templates and reduce the customizability in exchange for higher system safety.

The goal of this story is to provide a configuration option, which allows System Administrators to completely disable creation of new DDM Templates for the whole system (all of its virtual instances). When DDM Templates are disabled, it should not be possible to create new DDM templates through any UI or API.

This must be done for the old DDM APIs as well as for the new Data Engine APIs

-

Given the system administrator has disabled Template creation in "System settings" > "Enable Data Mapping"

-

When a user is trying to create a template from Product Menu "Web Content " > "Template"

Then the "+" button to add a Template should be hidden  (see videos attached)

-

When a template is already created (before disabling)

Then the user should be able to save changes to the existing template but not for newly created ones

-

Test Scenarios

Test Scenarios	Test Strategy	Kind of test	Is it covered by FrontEnd ? (JS-Unit)	Is it covered by BackEnd ? (unit or integration)	Could it be covered by POSHI?
The Add FreeMarker button should be hidden when disable template creation in Dynamic Data Mapping	Critical	Manual	No	No	Yes
The user is able to save changes in existing template when disable template creation in Dynamic Data Mapping	Critical	Manual	No	No	Yes
The creation of template is not allowed when disable template creation in Dynamic Data Mapping	High	Manual	No	No	Yes