Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-90939

GDPR : Message board posts made anonymously end up in user's export ZIP file.

    Details

    • Type: Bug
    • Status: Open
    • Resolution: Unresolved
    • Affects Version/s: 7.0.0 DXP FP71
    • Fix Version/s: None
    • Component/s: User Management
    • Labels:

      Description

      A user making a message board post anonymously isn't actually making an anonymous post, all that's happening is their username is being obscured (but exposed by "My Posts" tab). When the user is processed for GDPR export their anonymous posts are being included in the export, potentially exposing them to the data handler or anyone with access to the exported zip file as the author of anonymous posts.

      Expected
      User's exported data shouldn't include posts that were made anonymously before GDPR was enacted. User should have some better assurances that they won't be exposed as the author of a post to the data handler (if the data handler should maliciously open the password free zip file).

      Actual
      User's exported data include posts made anonymously before GDPR was enacted.

      Note: This is an ongoing issue with liferay where anonymous posts are not dis-associated with the user who authored the post and the author continues to be exposed through various malicious attempts to expose the true author.

        Attachments

        1. 316798.xml
          0.9 kB
        2. 38164.xml
          2 kB
        3. user-facing-information.JPG
          user-facing-information.JPG
          16 kB
        4. user-name-exposed.JPG
          user-name-exposed.JPG
          31 kB

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Days since last comment:
                34 weeks ago

                Packages

                Version Package