Submit Feedback
Legacy Knowledge Base
Published Jul. 2, 2025

User is Able to Access Web Content Functions Without Proper Permissions

Written By

Nimród Papp

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

This article documents a known issue in LPE-15180 where users are able to access web content functions without proper permissions. This vulnerability was fixed by the Portal-143-6210 Fix Pack. However, this fix was limited to only newly created web content.

Resolution

To patch this issue in existing web content, users should execute the Groovy script attached below. As a best practice, please test the script in a non-production environment.

  1. Backup your database
  2. Navigate to Control Panel > Server Administration > Script 
  3. Select Groovy from the pull down menu
  4. Copy and paste the script into the text field
  5. Select Execute
  6. The script will gather all groups from all instances and then all of the preferences which have ownerid = 0, ownertype = 3, portletId = 15 or portletId = 160 and preferences = "<portlet-preferences />" or "<portlet-preferences></portlet-preferences>", listing them by default. If you would like to remove these entries, you will have to uncomment the delete command inside the script and then execute it again.
  7. After the script runs, please test thoroughly to ensure that everything continues to behave as expected. Any issues that are encountered should be reported to the Liferay Support team. 
Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?