Static resources of portlets are world-readable - how to restrict access?

[Michał Kochanowicz, geändert vor 9 Jahren.]

Hello

The static resources of portlets (images, style sheets) are world-readable by default. How to restrict access to them?

From what I see, they are accessed directly from web container (Tomcat for example) and as Liferay is bypassed it can not apply it's security.

Sample URL: http://localhost:8080/liferay-tests/userinfo/company_logo.png

This URL comes from liferay-tests.war and is world-readable without logging to Liferay.

Regards

[Rajeeva Lochana .B.R, geändert vor 9 Jahren.]

Hi Michał Kochanowicz,

Creating Servlet filter hook we can restrict access.

For reference: Check this link

Regards,
Rajeeva Lochana BR

[Michał Kochanowicz, geändert vor 9 Jahren.]

Unfortunately in servlet filter I don't have access to portlet session, so I can't check user permissions.

[David H Nebinger, geändert vor 9 Jahren.]

Michał Kochanowicz:

The static resources of portlets (images, style sheets) are world-readable by default. How to restrict access to them?

Um, without stylesheets how do you style the login?

From what I see, they are accessed directly from web container (Tomcat for example) and as Liferay is bypassed it can not apply it's security.

Sample URL: http://localhost:8080/liferay-tests/userinfo/company_logo.png

This URL comes from liferay-tests.war and is world-readable without logging to Liferay.

Yes, the URLs are open. That said, they do honor the permissions of the underlying assets. If the image does not have guest access, it won't display.

But many things do have guest access and some assets fall outside of this (the theme and other static assets) because a web site won't work without some guest access.

[Michał Kochanowicz, geändert vor 9 Jahren.]

I'm not asking about PORTAL resources. I'm asking about PORTLET resources. They're not needed to login.

Consider portlet created with Google Web Toolkit. Entire portlet is compiled to big JavaScript file. And this big JavaScript file can be downloaded by anybody without even logging into portal.

[David H Nebinger, geändert vor 9 Jahren.]

Michał Kochanowicz:

I'm not asking about PORTAL resources. I'm asking about PORTLET resources. They're not needed to login.

Consider portlet created with Google Web Toolkit. Entire portlet is compiled to big JavaScript file. And this big JavaScript file can be downloaded by anybody without even logging into portal.

These kinds of things should be opened as bugs. Jelmer, another community member, has been one of the harder voices on Liferay with respect to security...

For the GWT portlet, well in Liferay an admin can remove guest view for the portlet. I would expect that if guest view access was removed, then I should not be able to pull script.

But just because I expect it would work that way doesn't mean that Liferay does, it doesn't mean that they've considered this, and it doesn't mean they wouldn't share the same expectation.

It could just mean that it hasn't been reported as an issue and therefore hasn't been addressed.

[Tomas Polesovsky, geändert vor 9 Jahren.]

Hi Michal,

your plugin is a separate web application. Portal is not able to tell app server to not serve your web-app static files.

If you want portal to have control over your files, you can use for example portlet Resource Phase to serve the sensitive content through portlet.

HTH.

Best.