legacy-knowledge-base
公開されました Jul. 2, 2025

The /dtd/ folder of the war with sensitive information is exposed when deploying a portal on Weblogic 12c R2

written-by

Alfonso Abad

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

legacy-article

learn-legacy-article-disclaimer-text

Liferay Support does not recommend or endorse specific third-party products over others. The information provided about products not created by Liferay is for reference purposes only, and any implementation of these principles will be at your team's discretion.

Issue

  • After the creation of a portal on Weblogic using the war file the /dtd/ folder inside the deployment is exposed. This exposes versions of several components. For example, after the deployment when the Liferay portal is accessible add this particle to the base URL: /dtd/maven-v4_0_0.xsd 

Environment

  • DXP 7.2 with Weblogic 12c R2

Resolution

  • Is necessary to block the FileServlet that comes by tdefault on Weblogic that is also not recommended to use on Production enviroments (Reference at the bottom of this article). The steps to do it are the following:  

    1.  Got to the route:
    /[weblogic-home]/user_projects/domains/[liferay-home]/servers/[Servidor-Liferay]/stage/[Nombre de instalación]/[archivo-war-liferay]/WEB-INF
    Note: If the file is a compiled war it's needed to decompress and recompile it after the change on the step 2 is made. If is already decompressed there is no need to recompile it.

    2. Inside the route find the web.xml file. There find the last line with the tag: </servlet-mapping> (If it's the default file, the line is the 994) and below add the following:
    <servlet-mapping>
    <servlet-name>Web Server Servlet</servlet-name>
    <url-pattern>/</url-pattern>
    </servlet-mapping>
    3. Restart both the Liferay and the Weblogic servers.

Additional information

did-this-article-resolve-your-issue

legacy-knowledge-base