Site Search - Liferay Learn

Issue How can the signed response, which is required by ADFS to complete authentication at the Liferay end, be clarified? Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Resolution...

"Content security policy" header is not available in the application response

legacy

Issue The "Content security policy" header is not available in the application response. How to add or enable the CSP? Environment Liferay DXP 7.3 Resolution Liferay doesn't directly support the CSP as there are no...

Impact of Spring4Shell and Spring Cloud Security Advisory on other libraries related to Spring

legacy

Issue There previously was a Security Advisory regarding a vulnerability for the Spring4Shell and Spring Cloud libraries. These vulnerabilities are detailed in this article here: Spring4Shell and Spring Cloud Security...

Version of spring-** jars after installing a hotfix

legacy

Issue To address the Spring4Shell vulnerabilities, the patched version of spring-beans.jar should be in its manifest file after the hotfix installation, is spring-webmvc.jar included in this? Environment Liferay...

Guest users are able to access an endpoint if PortalSessionAuthVerifier is enabled

legacy Troubleshooting

Issue We have followed this How-To article: How to add security, authentication to my REST service? (Section 5.1), but guest users are still able to access our endpoint from a browser. If we enable...

Plain text can still be seen despite SSL

legacy

Issue Even if SSL (or TLS) is enabled, the login credentials are in plain text while intercepting requests with Burp Suite. Environment Liferay DXP 7.3 Resolution If a user utilizes the burp suite as a proxy, they...

Error "Invalid domain for site key" when using reCAPTCHA

legacy Troubleshooting

Issue When using Google's reCAPTCHA, the CAPTCHA option won't show, instead the message "Invalid domain for site key" is displayed where the CAPTCHA should be. Environment Any Liferay DXP version with...

log4j-core-2.13.3.jar exists inside the fix pack

legacy Troubleshooting

Issue This article highlights the concern with the following path of log4j lower version jars. {liferay_home}/patching-tool/patches/liferay-fix-pack-dxp-16-7210.zip!binaries/MODULES_BASE_PATH/marketplace/Liferay...

After changing the password, site members are not redirected to a page where they don't have the guest view permission

legacy Troubleshooting

Issue After changing the password, site members are not redirected to a page Steps to reproduce: 1) Start the server, login as Admin 2) Create a new page e.g. /testpage and remove the VIEW permission for the Guest...

Password reminder answers are not masked

legacy Troubleshooting

Issue As Liferay DXP does not hide password reminder answers, attackers can capture user's password reminder answers through man-in-the-middle or shoulder surfing attacks. Environment Liferay DXP 7.0 Liferay DXP...

Is there a REST API method to revoke the OAuth2 tokens?

legacy How To

Issue We want to provide a public REST API method to revoke the OAuth2 tokens following the RFC 7009 specification https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 Does Liferay provide this functionality?...

New user is not being able to login properly

legacy Troubleshooting

Issue A new user (this also happens to LDAP users) is unable to log-in the first time, but seems to be able to log-in on the second attempt. Steps to reproduce: 1) Create a guest user from Create Account tab at the...

'Authentication Search Filter' for Users in LDAP

legacy

Issue At the moment, we are using LDAP server connection to authenticate our users. Our question is: in which moment the query to authenticate users is executed? More exactly, when the field 'Authentication Search...

Microsoft Azure Key Vault with Liferay DB

legacy How To

Issue Can we use Azure Key Vault with DB setup configuration in Liferay instead of having it in plain text in the properties file? Is there any way to configure the DB in Liferay using Azure Key Vault? How we can use...

'Email Account Activity: New Sign-In detected for your account' received which is an unwanted email

legacy

Issue Receiving unwanted email notifications like "Your email account abc@xyz.org.in was signed into from a new location, device, browser, or application" from GoDaddy. Below are the details received: From:...

Are URLs that display/download Liferay JS information a vulnerability?

legacy

Issue Some monitoring tools may identify certain URLs that are accessible during routine scans that should not have allowed access. Among the URLs that are typically detected are URLs that can download Liferay's JS...

What is the user password algorithm and format of the stored passwords?

legacy

Issue We would like to understand the formatting of passwords as they're saved in Liferay. What algorithm, salt, and hash format is being used to store passwords? Environment DXP 7.1 Resolution Example Password:...

When trying to access a user's private page, a "404 Page Not Found" populates instead of the Login prompt

legacy

Issue When trying to access a user's private page, we are transferred to a "404 Page Not Found" error page instead of the Login page that we were expecting. Environment DXP 7.4 Quarterly Release Resolution Not being...

How to Disable CAPTCHA on Server Admin Pages

legacy How To

Issue How do you disable CAPTCHA on pages? Site Administration pages like the Gogo Shell now have a CAPTCHA verification. How do you disable CAPTCHA on pages? Adding “-1” (Never Check), doesn’t work....

Web Server keeps asking for basic authentication when using a Client Extension that makes a request via OAuth to Liferay API

legacy Troubleshooting

Issue A Web Server before the Liferay environment is configured with Basic Auth. Liferay uses a Client Extension (CX) that makes a request to a Liferay API using OAuth. When the page using the CX is loaded, the Web...

Search Results