Issue
- Even if Scripting Console is restricted to those with the server administration role, we would like to disable this scripting functionality in our 7.0 portal.
Environment
- DXP 7.0
Resolution
-
Scripting from Scripting Console can be disabled by blacklisting the following modules:
com.liferay.portal.scripting.executor-x.y.z.jar
com.liferay.portal.scripting.groovy-x.y.z.jar -
by adding the following values in the blacklistBundleSymbolicNames property in
com.liferay.portal.bundle.blacklist.internal.BundleBlacklistConfiguration.config (/osgi/configs folder):blacklistBundleSymbolicNames=["com.liferay.portal.scripting.executor","com.liferay.portal.scripting.groovy"]
Expected results: even if this will not remove the Scripting Console itself, scripts cannot be executed from Scripting Console.
Important note 1: Scripting API should not be disabled, as disabling it seems to break the Script page entirely. Disabling the mentioned 2 modules will not break the core functionality of the portal.
Important note 2: Please test this configuration in a test environment thoroughly first, before moving these changes to Production.
Additional Information