Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-43717

Ensure that instance level preferences for a portlet only exist if the portlet has been added to the page

    Details

      Description

      Some time ago (LPS-29288 / LPS-28990) it was decided that if a portlet has preferences at the instance level then it means that the portlet is on the page. This was done to solve a security issue with embedded portlets, however it has created a series of regressions and not all of may have arised.
      The problem is that the assumption "if a portlet has preferences at the instance level then it means that the portlet is on the page" is not currently holding true since such preferences are still created in some other situations. For example when doing a get for the preferences (See PortletPreferencesLocalServiceImpl.doGetPreferences()).

      As a result the LayoutTypePortlet.hasPortletId() returns true in many scenarios in which is not true. Because of this it is needed to do a thorough code review to identify all places where portlet preferences are created and ensure that they are never ever created unless the portlet is added to a page and always removed if it's no longer in the page.

      Additionally the following aspects must be considered in the hasPortletId method:

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                support-lep@liferay.com SE Support
                Reporter:
                jorge.ferrer Jorge Ferrer
                Recent user:
                Shalaka Tendulkar
                Participants of an Issue:
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:

                  Packages

                  Version Package