User profile is visible when accessing the /web/test

Issue

• When accessing localhost:8080/web/test, the user profile is visible to guest users. The concern is that the user data being accessible to guest users poses a security threat.
  

Environment

• Liferay DXP 7.4

Resolution

• Add the below property in portal-ext.properties file and set this to 'false'; after adding the portal property, when you access the "localhost:8080/web/test", it will not show the user profile and will redirect to the 404 error page.

  # Set whether or not public layouts are enabled. Set whether or not public
  # layouts should be auto created if a user has no public layouts. If public
  # layouts are not enabled, then the property
  # "layout.user.public.layouts.auto.create" is assumed to be false.
  #
  # Env: LIFERAY_LAYOUT_PERIOD_USER_PERIOD_PUBLIC_PERIOD_LAYOUTS_PERIOD_AUTO_PERIOD_CREATE
  # Env: LIFERAY_LAYOUT_PERIOD_USER_PERIOD_PUBLIC_PERIOD_LAYOUTS_PERIOD_ENABLED
  #
  layout.user.public.layouts.enabled=false

  Note:
  1. Configure the portal-ext.properties file with the above property and restart the server to see the changes.
  2. Check the behavior in the lower environment first; if everything works as expected, then move to the production as per your discretion.

Additional Information

• Additionally, if there is no need to use the personal sites, the above property will prevent new sites from being created. However, it doesn’t change the existing user personal sites.