Affects Version/s: 6.2.0 CE B3, 6.2.0 CE RC1
Fix Version/s: 6.2.0 CE RC1
Component/s: Core Infrastructure
Similar Issues:Show 5 results
LPS-3184 After applying the patch from LPS-3082 as a side effect request parameters become namespaced, making portlets not find it's parameters LPS-44604 Reading namespace parameter in portlet action method LPS-25380 Form parameters should not be namespaced LPS-39734 Upgrade Plugins SDK JSF portlet templates to Liferay Faces 3.2.4-ga5 for compatibility with Liferay Portal 6.2 LPS-14771 [XSS] Vulnerability in url parameter p_p_id and portlet:namespace taglib
Strict namespacing of parameters was introduced in
LPS-35309 with the following commit:
4a22300e27f2e333a309b4f6812f4de25a2fdf97 "Make PortletRequestImpl only accepting namespaced parameters"
But currently the namespacing is enforced for all types of portlets except JSF portlets. The problem is caused by the following method:
I believe that the check for !invokerPortlet.isFacesPortlet() was added many years ago in
LEP-581 since JSF portlet bridges automatically namespace input parameters, and expect that parameters will continue to have the namespace when received in a postback.
So even though JSF portlets expect strict namespacing of parameters, they are currently unable to participate with the feature, since name and realName are always equal for JSF portlets in the following condition:
In order to fix this problem, the code needs to be modified so that JSF portlets with (requiresNamespacedParameters == true) (the default) can have namespaced parameters set on the dynamicRequest, just like other portlets. However, backwards compatibility with (requiresNamespacedParameters == false) must be maintained.