Site Search - Liferay Learn

Does CVE-2022-34305 affect Liferay?

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue...

Portal prints error stacktrace on the browser, disclosing technical information

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue When navigating some incorrectly crafted URLs...

Error message is not displayed when an error occurs in JSONWS

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue...

Unable to send message: 554 X.X.XXX SendAsDenied

legacy Troubleshooting

Issue When sending emails, the error "unable to send message: 554 X.X.XXX SendAsDenied" occurs. Steps to reproduce: 1. Configure the outlook mail server to send email notifications in Liferay 2. Sometimes, the...

JSESSIONID not secure by default

legacy Troubleshooting

Issue The JSESSIONID cookie that comes with Liferay requests in the browser is not secure by default when inspected in the browser. Environment Liferay DXP 7.3 Resolution Set the JSESSIONID in web.xml...

Could not connect to the SMTP host exceptions

legacy Troubleshooting

Issue When sending emails, the error "unable to send message: Could not connect to SMTP host: smtp.office365.com, port: 587" occurs. Steps to reproduce: 1. Configure the outlook mail server to send email...

What should be done when answers to the security questions are forgotten?

legacy How To

Issue My users keep forgetting their answers to the security questions is there a way to disable this? Also is there an alternative to the forgot password option? Environment DXP 7.4 Resolution Liferay already sends a...

Unable to process SAML request

legacy Troubleshooting

Issue Some users are unable to login via SAML Steps to reproduce: Login User for the first time The user gets logged-in successfully Now, log out and try logging in again Result: Throws unable to process SAML...

After configuring a CDN, Liferay does not load images and throws error in browser console

legacy Troubleshooting

Issue We have configured a CDN with our Liferay environment. The portal is unable to load Liferay JS/CSS and images and we see errors in the browser console: Access to XMLHttpRequest at 'https...(CDN)' from origin...

SSO SP connection doesn't send unauthenticated users to /c/portal/login

legacy How To

Issue Once we setup a SAML SP connection, the SAML adapter doesn't recognize unauthenticated users and redirect them to /c/portal/login Environment DXP 7.4 Resolution This is intended behavior with the “Prompt Enabled”...

User is redirected to the 404 page instead of the login page when the session expires.

legacy How To

Issue The user is not prompted for login but to a 404 page when navigating in pages with restricted access if the user session expires or, if the user is not logged in and tries to access directly the url. ...

0Auth2.0 issues new token every time even before token's expiration time

legacy

Issue The access_token expiration default is set to 10 minutes. When invoking the /oauth2/token before the previous token expires, a brand new token is issued instead of the original token. Environment DXP 7.4...

Does having a script in a fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in a fragment's HTML section where the code can be executed, when the fragment is opened, like <img src=x onerror="alert(document.cookie)"> Can that be a vulnerability to...

Does having a script in a button fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put a Javascript code in the Button fragment's URL field, so it can be executed when we click on the button, like javascript:alert(document.cookie) Can that be a vulnerability to Cross Site...

Liferay accepts only fully signed SAML responses. Can this requirement be turned off?

legacy

Issue From a security standpoint, it's a best practice to sign the Response. However, we can switch off this requirement in our other apps. I can understand that Liferay by default requires the complete signature of...

Does CVE-2022-1471 affects DXP 7.4?

legacy Troubleshooting

Issue Our scanner reported that the Liferay DXP image as well as the Elasticsearch image are vulnerable to CVE-2022-1471, which is about an issue with SnakeYaml. Could you please confirm if we have to address this...

Is Liferay vulnerable to CVE-2023-40371 and CVE 2023-38408?

legacy

Issue Is Liferay vulnerable to any of these vulnerabilities? Environment DXP 6.2+ Resolution No, Liferay is not vulnerable to any of these two. Neither CVE relates to any Liferay features, so they do not...

How to extract the okta authorization token for each user?

legacy Troubleshooting

Issue Once users log in to Liferay, the user should get redirected to Okta. After successful authentication, Okta is supposed to return an authorization token for that specific user. Concern: After successful Okta...

Unable to extend user session on Weblogic

legacy Troubleshooting

Issue When I call Liferay.Session.extend(); from Liferay 7.4 running on Weblogic, the user session terminates. Environment DXP 7.4 Weblogic Resolution This behavior is resolved by LPS-190923. Please open a help...

AuditEvent not saved after migrating from Portal 6.2 to DXP 7.4

legacy Troubleshooting

Issue After migrating to DXP 7.4. If we use the portal normally, there aren't new entries in Audit_AuditEvents table. Environment Liferay DXP 7.4 Resolution Go to System Settings -> Audit -> Persistent...

Search Results