PortletRequestImpl not enforcing namespaced parameters for JSF portlets

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 6.2.0 CE B3, 6.2.0 CE RC1
• Fix Version/s: 6.2.0 CE RC1
• Component/s: Core Infrastructure
• Labels: None
• Fix Priority: 5

Strict namespacing of parameters was introduced in LPS-35309 with the following commit:

4a22300e27f2e333a309b4f6812f4de25a2fdf97 "Make PortletRequestImpl only accepting namespaced parameters"

But currently the namespacing is enforced for all types of portlets except JSF portlets. The problem is caused by the following method:

protected String removePortletNamespace(
	InvokerPortlet invokerPortlet, String portletNamespace, String name) {

	if (name.startsWith(portletNamespace) &&
		((invokerPortlet == null) || !invokerPortlet.isFacesPortlet())) {

		name = name.substring(portletNamespace.length());
	}

	return name;
}

I believe that the check for !invokerPortlet.isFacesPortlet() was added many years ago in LEP-581 since JSF portlet bridges automatically namespace input parameters, and expect that parameters will continue to have the namespace when received in a postback.

So even though JSF portlets expect strict namespacing of parameters, they are currently unable to participate with the feature, since name and realName are always equal for JSF portlets in the following condition:

protected void init(
	HttpServletRequest request, Portlet portlet,
	InvokerPortlet invokerPortlet, PortletContext portletContext,
	WindowState windowState, PortletMode portletMode,
	PortletPreferences preferences, long plid) {

	...
	String realName = removePortletNamespace(
		invokerPortlet, portletNamespace, name,
		requiresNamespacedParameters);

	if (!realName.equals(name) ||
		!portlet.isRequiresNamespacedParameters()) {

		dynamicRequest.setParameterValues(realName, values);
	}
	...
}

In order to fix this problem, the code needs to be modified so that JSF portlets with (requiresNamespacedParameters == true) (the default) can have namespaced parameters set on the dynamicRequest, just like other portlets. However, backwards compatibility with (requiresNamespacedParameters == false) must be maintained.