Static resources of portlets are world-readable - how to restrict access?

[Michał Kochanowicz，修改在9 年前。]

Hello

The static resources of portlets (images, style sheets) are world-readable by default. How to restrict access to them?

From what I see, they are accessed directly from web container (Tomcat for example) and as Liferay is bypassed it can not apply it's security.

Sample URL: http://localhost:8080/liferay-tests/userinfo/company_logo.png

This URL comes from liferay-tests.war and is world-readable without logging to Liferay.

Regards

[Rajeeva Lochana .B.R，修改在9 年前。]

Hi Michał Kochanowicz,

Creating Servlet filter hook we can restrict access.

For reference: Check this link

Regards,
Rajeeva Lochana BR

[Michał Kochanowicz，修改在9 年前。]

Unfortunately in servlet filter I don't have access to portlet session, so I can't check user permissions.

[David H Nebinger，修改在9 年前。]

Michał Kochanowicz:

The static resources of portlets (images, style sheets) are world-readable by default. How to restrict access to them?

Um, without stylesheets how do you style the login?

From what I see, they are accessed directly from web container (Tomcat for example) and as Liferay is bypassed it can not apply it's security.

Sample URL: http://localhost:8080/liferay-tests/userinfo/company_logo.png

This URL comes from liferay-tests.war and is world-readable without logging to Liferay.

Yes, the URLs are open. That said, they do honor the permissions of the underlying assets. If the image does not have guest access, it won't display.

But many things do have guest access and some assets fall outside of this (the theme and other static assets) because a web site won't work without some guest access.

[Michał Kochanowicz，修改在9 年前。]

I'm not asking about PORTAL resources. I'm asking about PORTLET resources. They're not needed to login.

Consider portlet created with Google Web Toolkit. Entire portlet is compiled to big JavaScript file. And this big JavaScript file can be downloaded by anybody without even logging into portal.

[David H Nebinger，修改在9 年前。]

Michał Kochanowicz:

I'm not asking about PORTAL resources. I'm asking about PORTLET resources. They're not needed to login.

Consider portlet created with Google Web Toolkit. Entire portlet is compiled to big JavaScript file. And this big JavaScript file can be downloaded by anybody without even logging into portal.

These kinds of things should be opened as bugs. Jelmer, another community member, has been one of the harder voices on Liferay with respect to security...

For the GWT portlet, well in Liferay an admin can remove guest view for the portlet. I would expect that if guest view access was removed, then I should not be able to pull script.

But just because I expect it would work that way doesn't mean that Liferay does, it doesn't mean that they've considered this, and it doesn't mean they wouldn't share the same expectation.

It could just mean that it hasn't been reported as an issue and therefore hasn't been addressed.

[Tomas Polesovsky，修改在9 年前。]

Hi Michal,

your plugin is a separate web application. Portal is not able to tell app server to not serve your web-app static files.

If you want portal to have control over your files, you can use for example portlet Resource Phase to serve the sensitive content through portlet.

HTH.

Best.