Site Search - Liferay Learn

What should be done when answers to the security questions are forgotten?

Issue My users keep forgetting their answers to the security questions is there a way to disable this? Also is there an alternative to the forgot password option? Environment DXP 7.4 Resolution Liferay already sends a password reset link when users click on Forgot Password, provided that...

0Auth2.0 issues new token every time even before token's expiration time

legacy

Issue The access_token expiration default is set to 10 minutes. When invoking the /oauth2/token before the previous token expires, a brand new token is issued instead of the original token. Environment DXP 7.4 Resolution This behavior is expected. Unfortunately, Liferay cannot be...

Does having a script in a button fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put a Javascript code in the Button fragment's URL field, so it can be executed when we click on the button, like javascript:alert(document.cookie) Can that be a vulnerability to Cross Site Scripting (XSS)? Environment Liferay DXP 7.3+ Resolution We allow adding scripts to...

Does having a script in a fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in a fragment's HTML section where the code can be executed, when the fragment is opened, like <img src=x onerror="alert(document.cookie)"> Can that be a vulnerability to Cross Site Scripting (XSS)? Environment Liferay DXP 7.3+ Resolution This is the...

Unable to process SAML request

legacy Troubleshooting

Issue Some users are unable to login via SAML Steps to reproduce: Login User for the first time The user gets logged-in successfully Now, log out and try logging in again Result: Throws unable to process SAML request error on UI, and Invalid NameId Policy error in the logs. Environment...

After configuring a CDN, Liferay does not load images and throws error in browser console

legacy Troubleshooting

Issue We have configured a CDN with our Liferay environment. The portal is unable to load Liferay JS/CSS and images and we see errors in the browser console: Access to XMLHttpRequest at 'https...(CDN)' from origin 'https...(liferay)' has been blocked by CORS policy. No...

Liferay accepts only fully signed SAML responses. Can this requirement be turned off?

legacy

Issue From a security standpoint, it's a best practice to sign the Response. However, we can switch off this requirement in our other apps. I can understand that Liferay by default requires the complete signature of the response, but could this be turned off somehow? Environment DXP 7.3+...

Does CVE-2022-1471 affects DXP 7.4?

legacy Troubleshooting

Issue Our scanner reported that the Liferay DXP image as well as the Elasticsearch image are vulnerable to CVE-2022-1471, which is about an issue with SnakeYaml. Could you please confirm if we have to address this vulnerability? Environment DXP 7.4 Resolution CVE-2022-1471 was addressed...

How to extract the okta authorization token for each user?

legacy Troubleshooting

Issue Once users log in to Liferay, the user should get redirected to Okta. After successful authentication, Okta is supposed to return an authorization token for that specific user. Concern: After successful Okta authentication through OIDC, users are not able to get the token from...

Unable to extend user session on Weblogic

legacy Troubleshooting

Issue When I call Liferay.Session.extend(); from Liferay 7.4 running on Weblogic, the user session terminates. Environment DXP 7.4 Weblogic Resolution This behavior is resolved by LPS-190923. Please open a help center ticket requesting a hotfix at your update level., content:...

AuditEvent not saved after migrating from Portal 6.2 to DXP 7.4

legacy Troubleshooting

Issue After migrating to DXP 7.4. If we use the portal normally, there aren't new entries in Audit_AuditEvents table. Environment Liferay DXP 7.4 Resolution Go to System Settings -> Audit -> Persistent Message Audit Message Processor. Enable this configuration and save. , content:...

Is One Time Password's expiration configurable?

legacy

Issue When does One Time Password expire? Can you set the validity timeframe of the OTP? Environment DXP 7.2+ Resolution OTP is HTTP session based, if the session expires, OTP expires as well. And it can only be used in the same HTTP session. Since OTP expiration is tied to the HTTP...

Security configuration related to session management

legacy

Issue There are some security configuration requirement regarding session management. Environment Liferay DXP 7.4 Resolution Application uses the 'referrer' header as a supplemental check only, and not just for any authorization check. Liferay does not rely on the referrer header for any...

OpenID Connect Error - "Signed JWT rejected"

legacy Troubleshooting

Issue When configuring authentication using OpenID Connect, login fails and the following error is reported: Unable to validate tokens: Signed JWT rejected: Another algorithm expected, or no matching key(s) found This error arises when the RS265 is not listed as the first supported...

Browser Pop-Up For Non-Https Site

legacy Troubleshooting

Issue We are seeing a browser pop-up warning for our users when they try to login to our http site. They become concerned as it says the connection is not secure, but to 'send anyway'. Can this be disabled by Liferay or bypassed somehow? Environment DXP 7.0 | DXP 7.1 | DXP 7.2 | DXP 7.3...

Is Liferay's SAML Service Provider Logout URL required in the Identity Provider?

legacy Troubleshooting

Issue Azure's SAML Identity Provider (IdP) marks the Service Provider's (SP) Logout URL as "optional" However, when I remove Liferay's Logout URL from Azure's SAML configurations, Liferay users are not signed out completely from Liferay after signing out through Azure. Is it necessary to...

XSS and Web Content editing

legacy Troubleshooting

Issue Web Content Editing If a script is added to the content field and published, the script is executed when the article is displayed. Accessing the page triggers an alert each time. Allowing such content could assist the creator to perform an XSS attack. Environment DXP 7.0 ~ DXP 7.4...

Where is the password reset email set up and in what priority order?

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue It seems that I can set up the password reset email in multiple places,...

I am redirected to the home guest page after login with SAML

legacy Troubleshooting

Issue After logging in with SAML, I am redirected to the Home Page of a non-logged-in user. I am redirected back to the Portal login screen after login with SAML Environment Portal 6.2 DXP 7.0+ Resolution This can be caused because auto-login is not allowed, which results in being...

Does Liferay DXP validate Session Identifiers?

legacy

Issue Does Liferay DXP validate Session Identifiers? And yes, Liferay does validate Session Identifiers! Environment Liferay DXP Resolution As for the session configuration in the portal we have the...

Does CVE-2016-1000027 affect Liferay?

legacy

Issue Security scan shows CVE-2016-1000027 as an active vulnerability, is Liferay affected? Environment DXP 7.4 Resolution CVE-2016-1000027 is known to us, and we can confirm that Liferay should not be vulnerable, as Liferay does not use the following components:...

Does CVE-2022-47966 affect Liferay?

legacy

Issue Our security scan has shown CVE-2022-47966 as an active critical vulnerability. Is Liferay affected? Environment DXP 7.2 Resolution The out-of-the-box Liferay product is not affected by this vulnerability. So, unless you use this library in a custom implementation, your system can...

Insecure HTTP methods

legacy How To

Issue HTTP methods like HEAD, OPTIONS, TRACE may provide information about the application that can be used in attacks like XST, CSRF, steal of sensitive information. How we can disable insecure/unnecessary http methods? How to enable the SECURE attribute to disallow the cookie to be...

SQL injection Sleepy user agent attack

legacy

Issue Liferay does not restrict a URL that has a 'sleepy user agent' query appended to it like: https://domain/page?1%2b(select*from(select(sleep(x)))a)%2b=1 Environment Liferay DXP 7.4 Resolution Sleepy user agent payload gets a page in sleep mode(inactive) for x seconds of time, which...

SAML Download Certificate button is broken, with Redirect URL errors seen

legacy Troubleshooting

Issue The Download Certificate button doesn't work in the SAML Admin. When I click on the Download Certificate button, nothing happens. Redirect URL errors are seen in Liferay logs, such as: [http-nio-8080-exec-10][PortalImpl:991] Redirect URL...

SAML Admin - "Metadata XML is null" error

legacy Troubleshooting

Issue When attempting to create a new Identity Provider under SAML Admin, having entered the required information, when ‘Save’ is clicked the UI displays: "Error: Please enter a valid identity provider entity ID." The logs show: INFO [http-nio-8084-exec-19][SamlAdminPortlet:77] Metadata...

Disabling jQuery in Control Panel

legacy How To

Issue I've found vulnerabilities in our current jQuery version. Since I can't find jQuery used anywhere, I would like to disable it. Environment Liferay DXP 7.2 Resolution Go to Control Panel --> System Settings --> Third Party --> jQuery Tick off the Enable jQuery checkbox Save,...

Blank screen is seen after password reset

legacy Troubleshooting

Issue A blank screen (with url http://localhost:8080/c) is seen after user password is reset. The expected behavior after password reset is for users to A) be successfully redirected to Liferay home page and B) remain logged in. However, in DXP 7.4 u50 (and below)...

Not Found page seen instead of Login Prompt when logged out and navigating to private pages

legacy How To

Issue When not logged in, and user attempts to navigate to private page's URL, instead of being prompted to log in, a 'Not Found' page is seen instead. Environment DXP 7.4 Resolution In DXP 7.3, when users are not logged in and they navigate to a private page's URL, they are prompted to...

Users see the message "Redirecting to your identity provider" before redirecting to OKTA login screen

legacy Troubleshooting

Issue The guest user observed the message "Redirecting to your identity provider" showed up before the OKTA user login screen showed up. The behavior just happened after upgrading the environment to 7.4 Update 56. We don't want the front-end users to see this message. Environment...

How to protect against the vulnerabilities related to SnakeYaml in version 1.27

legacy Troubleshooting

Issue How can I mitigate vulnerability CVE-2022-38749, CVE-2022-38750, CVE-2022-38751 and CVE-2022-38752 regarding Liferay DXP? Environment Liferay Portal 6.2 EE Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 (until the U47) Resolution Upgrade to Liferay...

Cannot set proper permissions for Panel Category Entries in a Custom Site

legacy Troubleshooting

Issue The custom site panel category entries' panel app permissions do not work as intended. We are unable to grant permissions to access the panel app through a "Site role" if the category key does not start with "site_administration." It will only work if we grant the permission with a...

Vulnerability：About CVE-2022-45143

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue Does the Apache Tomcat vulnerabilityCVE-2022-45143affect Liferay?...

Unable to bind to the LDAP server javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]

legacy Troubleshooting

Issue Unable to connect to Open LDAP in DXP due to the following UI error Environment Liferay DXP 7.4 Resolution These errors typically occur when Liferay is unable to communicate with LDAP or when mapping mistakes are made. As a result, please ping both servers to ensure that they can...

Detected Vulnerabilities related to Struts

legacy

Issue A security scan has picked up the following vulnerabilities related to struts-core: CVE-2012-1007, CVE-2014-0112 CVE-2014-0112: ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to...

How to monitor who and what deleted pages or any data

How To

Issue I would like to check who and what deleted pages or data from the Liferay system. Environment Liferay DXP 7.3 Liferay DXP 7.4 Resolution There are two ways of checking who and what deleted data: 1. From the UI by utilizing the Audit option, by going to the main menu on the upper...

How to update moment.js library

legacy Troubleshooting

Issue For security reasons we need to update the moment.js library from version 2.24.0 to version 2.29.4 How do I update the moment.js library in Liferay DXP? Security vulnerabilities in moment.js 2.24.0: CVE-2022-31129, CVE-2022-24785 Environment Liferay DXP 7.1+ Resolution The...

How to set SameSite cookie attribute to Strict within Tomcat

How To

Issue How can I adjust the JSESSIONID cookie's SameSite attribute from None to Strict? Environment Liferay DXP 7.1 - 7.4 Resolution The JSessionID cookie's attributes are set by your application server or web server. When using a Liferay environment with a bundled Tomcat application...

Errors Suggesting a Search Bot Attack

legacy Troubleshooting

Issue We are seeing many abnormal errors in our Liferay catalina logs all of sudden. We have tried restarting, but the errors continue. What could these mean? ERROR [ajp-nio-0.0.0.0-8009-exec-19][MVCPortlet:557] ${@print(md5(31337))}\ is not a valid include ERROR...

Existing users password encryption algorithm is not updated on password reset

legacy Troubleshooting

Issue The password encryption algorithm of existing users is not being updated after doing a password reset. Environment DXP 7.4 Resolution To resolve this behavior, open a help center ticket to request a hotfix containing LPS-165014, or update your installation to DXP 7.4 update 54 and...

Special characters which are used for XSS can be saved as an input without any warning

legacy

Issue Characters as <, >, /, (, ), ", ' which can be used to make scripts, used in HTML and JavaScript are valid to use in the portal as inputs and values, and it can raise security questions The use of these characters did not throw any warning or error messages, neither on the UI nor...

Is there a limit to the number of IdPs registered?

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue Is there a limit to the number of IdPs registered? Environment DXP7.2+...

Search in Control Panel > Audit makes long URL

legacy

Issue A search in Control Panel > Security > Audit always sends empty search parameters in the GET URL. As a result, URLs are very long and can be blocked by firewall-infrastructure. Steps to reproduce: Navigate to Control Panel > Security > Audit Search for "test" Result: URL is very...

Detected vulnerabilities related to Jettison

legacy Troubleshooting

Issue A security scan has picked up the following vulnerabilities related to jettison-1.x.x jar: CVE-2022-40150 & CVE-2022-40149. This jar is found in marketplace\Liferay Foundation - Liferay Portal Remote - Impl.lpkg\com.liferay.portal.remote.rest.extender-6.0.12.jar\lib directory....

Behavior when a session expires while posting on the bulletin board

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue What happens if I am editing a thread or message on the BBS widget and...

How to change the number of digits in the CSRF token parameter "p_auth

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue Can I change the number of digits in the CSRF token parameter "p_auth"?...

The screen name cannot be an email address or a reserved word

legacy Troubleshooting

Issue When trying to log in with an Active Directory user, sign-in failed with the below error ERROR [http-nio-8080-exec-9][BaseSamlStrutsAction:59] Screen name test@liferay.com for user 34945 must validate with com.liferay.portal.kernel.security.auth.DefaultScreenNameValidator: The...

How to protect against CVE-2022-41853 vulnerability

legacy Troubleshooting

Issue How can I mitigate vulnerability CVE-2022-41853 regarding Liferay DXP? Environment Liferay Portal 6.2 EE Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Resolution CVE-2022-41853 : This vulnerability has been fully fixed with the following LPS-165641 ...

Liferay Security Scanning

legacy

Issue What procedures does Liferay follow to perform security scanning? Environment Liferay DXP Resolution Liferay uses DAST and SAST tools for scanning. Pen test and manual code reviews are performed as well. The internal procedures are classified as proprietary information since a lot...

Link doesn't work in Knowledge base when a non-standard protocol is chosen.

legacy Troubleshooting

Issue When adding the notes:// protocol to a link in Knowledge Base, AntiSamy removes it and displays it as text. Environment Liferay DXP 7.2, 7.3 Resolution By default, everything is sanitized by AntiSamy, with 3 exceptions (JournalArticle, BlogsEntry and FragmentEntry). Knowledge...

Are Unique Email Addresses Required for Authentication

legacy

Issue Our company has a few external clients whose users have unique screen names, but all share one email address. This is causing various conflicts such as two users being unable to sign in simultaneously. The error in log looks like this below: WARN [https-jsse-nio-0000-exec-000]...

How to Login after Blacklisting the Sign-In Portlet

legacy Troubleshooting

Issue We Blacklisted the Sign-In Portlet with a third-party authentication application and the admin logins were not synchronized in the process and so now we can no longer access our environment. How can we restore access? Environment DXP 7.1 Resolution The best option, in this case,...

Allowing Local Liferay Admin Users to Authenticate when LDAP is Configured on the Virtual Instance

How To

Context When a main Liferay instance and a second virtual instance are both connected to the same LDAP server, local Liferay admin users are unable to log in when the “Required” box is checked. In the case where the LDAP is connected and the “Enabled” box is checked, all LDAP users are...

SAML IDP is unable to initiate SLO

legacy Troubleshooting

Issue SAML Identity Provider is unable to initiate Single Log Out Notes 1. Set the different virtual hosts as below as an example 127.0.0.1www.bbb.com (For IDP) 127.0.0.1www.sp.com (For SP) 2. Using thetest testuser in this test. Make sure the user share the same password in IDP and SP...

Records are not removed from samlspsession table if the user closes the browser instead of logging out

legacy Troubleshooting

Issue Records are not removed from `samlspsession` table if the user closes the browser instead of logging out. Steps to reproduce: 1. Setup two instances of Liferay to use SAML - one as IDP and one as SP. log into the SP 2. Verify record is created in the SAMLSPSESSION table (in the SP...

Resource and Global scopes tabs are not listing under oAuth2 administration scopes

legacy How To

Issue I not see the Resource and Global Sub-tabs under the Scopes tab on Oauth2 clients (in Control Panel/ OAuth2 Administration) Environment 7.3+ Resolution After https://issues.liferay.com/browse/LPS-105158 the scope graphic interface change. There is an explanation on...

Can both Liferay and LDAP Password policies be enabled at the same time?

legacy

Issue Is there a way to make both of Liferay and LDAP policies work together, so that users logging via Liferay authentication will be handled by Liferay's password policies and users authenticating with LDAP will be handled by LDAP's password policies? Environment 7.2 DXP Resolution If...

EU Login via OpenID Connect needs Proof Key for Code Exchange (PKCE)

legacy

Issue I would like to integrate my portal with an EU Login mock server instance via OpenID Connect It does not work since the OpenID connect server needs Proof Key for Code Exchange (PKCE) After configuration, when I am being redirected from Liferay to the EU Login server instance, I am...

LDAP Import Enabled under SAML settings

legacy

Issue What is the actual functionality of LDAP Import Enabledunder SAML settings Environment Liferay DXP 7.2, 7.3, 7.4 SAML Resolution Checking LDAP Import Enabled under SAML settings affects 3 functions: 1. The SAML NameID or SAML attributes (depending on the selected “User Resolution”...

Authentication flow in Liferay when LDAP is enabled

legacy

Issue Liferay is configured to use LDAP When Liferay Authentication will happen? When LDAP Authentication will happen? Environment Liferay DXP 7.0 -7.4 Resolution LDAP authentication always happens before Liferay Authentication. That is becauseLDAPAuthservice is registered...

Search Results