Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-39748

PortletRequestImpl not enforcing namespaced parameters for JSF portlets

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 6.2.0 CE B3, 6.2.0 CE RC1
    • Fix Version/s: 6.2.0 CE RC1
    • Component/s: Core Infrastructure
    • Labels:
      None
    • Fix Priority:
      5

      Description

      Strict namespacing of parameters was introduced in LPS-35309 with the following commit:

      4a22300e27f2e333a309b4f6812f4de25a2fdf97 "Make PortletRequestImpl only accepting namespaced parameters"

      But currently the namespacing is enforced for all types of portlets except JSF portlets. The problem is caused by the following method:

      protected String removePortletNamespace(
      	InvokerPortlet invokerPortlet, String portletNamespace, String name) {
      
      	if (name.startsWith(portletNamespace) &&
      		((invokerPortlet == null) || !invokerPortlet.isFacesPortlet())) {
      
      		name = name.substring(portletNamespace.length());
      	}
      
      	return name;
      }
      

      I believe that the check for !invokerPortlet.isFacesPortlet() was added many years ago in LEP-581 since JSF portlet bridges automatically namespace input parameters, and expect that parameters will continue to have the namespace when received in a postback.

      So even though JSF portlets expect strict namespacing of parameters, they are currently unable to participate with the feature, since name and realName are always equal for JSF portlets in the following condition:

      protected void init(
      	HttpServletRequest request, Portlet portlet,
      	InvokerPortlet invokerPortlet, PortletContext portletContext,
      	WindowState windowState, PortletMode portletMode,
      	PortletPreferences preferences, long plid) {
      
      	...
      	String realName = removePortletNamespace(
      		invokerPortlet, portletNamespace, name,
      		requiresNamespacedParameters);
      
      	if (!realName.equals(name) ||
      		!portlet.isRequiresNamespacedParameters()) {
      
      		dynamicRequest.setParameterValues(realName, values);
      	}
      	...
      }
      

      In order to fix this problem, the code needs to be modified so that JSF portlets with (requiresNamespacedParameters == true) (the default) can have namespaced parameters set on the dynamicRequest, just like other portlets. However, backwards compatibility with (requiresNamespacedParameters == false) must be maintained.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                brian.chan Brian Chan
                Reporter:
                neil.griffin Neil Griffin
                Participants of an Issue:
                Recent user:
                Esther Sanz
              • Votes:
                1 Vote for this issue
                Watchers:
                7 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Days since last comment:
                  3 years, 42 weeks, 1 day ago

                  Subcomponents