PUBLIC - Liferay Portal Community Edition
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-39748

PortletRequestImpl not enforcing namespaced parameters for JSF portlets

    Details

    • Type: Bug Bug
    • Status: Closed
    • Resolution: Fixed
    • Affects Version/s: 6.2.0 CE B3, 6.2.0 CE RC1
    • Fix Version/s: 6.2.0 CE RC1
    • Component/s: Core Infrastructure
    • Labels:
      None
    • Fix Priority:
      5
    • Similar Issues:
      Show 5 results 

      Description

      Strict namespacing of parameters was introduced in LPS-35309 with the following commit:

      4a22300e27f2e333a309b4f6812f4de25a2fdf97 "Make PortletRequestImpl only accepting namespaced parameters"

      But currently the namespacing is enforced for all types of portlets except JSF portlets. The problem is caused by the following method:

      protected String removePortletNamespace(
      	InvokerPortlet invokerPortlet, String portletNamespace, String name) {
      
      	if (name.startsWith(portletNamespace) &&
      		((invokerPortlet == null) || !invokerPortlet.isFacesPortlet())) {
      
      		name = name.substring(portletNamespace.length());
      	}
      
      	return name;
      }
      

      I believe that the check for !invokerPortlet.isFacesPortlet() was added many years ago in LEP-581 since JSF portlet bridges automatically namespace input parameters, and expect that parameters will continue to have the namespace when received in a postback.

      So even though JSF portlets expect strict namespacing of parameters, they are currently unable to participate with the feature, since name and realName are always equal for JSF portlets in the following condition:

      protected void init(
      	HttpServletRequest request, Portlet portlet,
      	InvokerPortlet invokerPortlet, PortletContext portletContext,
      	WindowState windowState, PortletMode portletMode,
      	PortletPreferences preferences, long plid) {
      
      	...
      	String realName = removePortletNamespace(
      		invokerPortlet, portletNamespace, name,
      		requiresNamespacedParameters);
      
      	if (!realName.equals(name) ||
      		!portlet.isRequiresNamespacedParameters()) {
      
      		dynamicRequest.setParameterValues(realName, values);
      	}
      	...
      }
      

      In order to fix this problem, the code needs to be modified so that JSF portlets with (requiresNamespacedParameters == true) (the default) can have namespaced parameters set on the dynamicRequest, just like other portlets. However, backwards compatibility with (requiresNamespacedParameters == false) must be maintained.

        Issue Links

          Activity

          Hide
          Neil Griffin added a comment - - edited

          JSF portlets are non-functional at this time unless the following is specified in WEB-INF/liferay-portlet.xml:

          <requires-namespaced-parameters>false</requires-namespaced-parameters>
          

          ... which is why this has been assigned a fix-priority of 5.

          Show
          Neil Griffin added a comment - - edited JSF portlets are non-functional at this time unless the following is specified in WEB-INF/liferay-portlet.xml: <requires-namespaced-parameters> false </requires-namespaced-parameters> ... which is why this has been assigned a fix-priority of 5.

            People

            • Assignee:
              Brian Chan
              Reporter:
              Neil Griffin
              Recent user:
              Michael Saechang
              Participants of an Issue:
            • Votes:
              1 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Days since last comment:
                1 year, 37 weeks, 1 day ago

                Development

                  Structure Helper Panel