Skip to content

LPD-72782 Create a configuration to remove client's IP from Liferay object #5209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
+262 −44
Open

LPD-72782 Create a configuration to remove client's IP from Liferay object #5209

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6142d9f
LPD-72782 Create a configuration to remove client's IP from Liferay o…
izaera Nov 28, 2025
533ebee
LPD-72782 Fix and improve test
izaera Nov 28, 2025
0b7f390
LPD-72782 Run "ant update-portal-osgi-configuration-properties"
izaera Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .../com/liferay/frontend/js/web/internal/configuration/LiferayGlobalObjectConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
/**
* SPDX-FileCopyrightText: (c) 2025 Liferay, Inc. https://liferay.com
* SPDX-License-Identifier: LGPL-2.1-or-later OR LicenseRef-Liferay-DXP-EULA-2.0.0-2023-06
*/

package com.liferay.frontend.js.web.internal.configuration;

import aQute.bnd.annotation.metatype.Meta;

import com.liferay.portal.configuration.metatype.annotations.ExtendedObjectClassDefinition;

/**
* @author Iván Zaera Avellón
*/
@ExtendedObjectClassDefinition(
category = "infrastructure",
scope = ExtendedObjectClassDefinition.Scope.COMPANY, strictScope = true
)
@Meta.OCD(
id = "com.liferay.frontend.js.web.internal.configuration.LiferayGlobalObjectConfiguration",
localization = "content/Language",
name = "liferay-global-object-configuration-name"
)
public interface LiferayGlobalObjectConfiguration {

@Meta.AD(
deflt = "false", description = "disable-get-remote-methods-help",
name = "disable-get-remote-methods", required = false
)
public boolean disableGetRemoteMethods();

}
54 changes: 50 additions & 4 deletions ...eray/frontend/js/web/internal/servlet/taglib/LiferayGlobalObjectPreAUIDynamicInclude.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,14 @@
package com.liferay.frontend.js.web.internal.servlet.taglib;

import com.liferay.exportimport.kernel.staging.Staging;
import com.liferay.frontend.js.web.internal.configuration.LiferayGlobalObjectConfiguration;
import com.liferay.layout.seo.kernel.LayoutSEOLink;
import com.liferay.layout.seo.kernel.LayoutSEOLinkManager;
import com.liferay.petra.string.CharPool;
import com.liferay.petra.string.StringBundler;
import com.liferay.petra.string.StringPool;
import com.liferay.portal.configuration.metatype.bnd.util.ConfigurableUtil;
import com.liferay.portal.configuration.module.configuration.ConfigurationProvider;
import com.liferay.portal.kernel.content.security.policy.ContentSecurityPolicyNonceProviderUtil;
import com.liferay.portal.kernel.exception.PortalException;
import com.liferay.portal.kernel.feature.flag.FeatureFlag;
Expand All @@ -23,6 +26,7 @@
import com.liferay.portal.kernel.model.LayoutTypePortlet;
import com.liferay.portal.kernel.model.User;
import com.liferay.portal.kernel.model.impl.VirtualLayout;
import com.liferay.portal.kernel.module.configuration.ConfigurationException;
import com.liferay.portal.kernel.security.auth.AuthToken;
import com.liferay.portal.kernel.security.permission.ActionKeys;
import com.liferay.portal.kernel.service.permission.LayoutPermission;
Expand Down Expand Up @@ -63,6 +67,7 @@
import java.text.Format;
import java.text.SimpleDateFormat;

import java.util.Collections;
import java.util.Locale;
import java.util.Map;
import java.util.TimeZone;
Expand All @@ -87,6 +92,9 @@ public void include(
HttpServletResponse httpServletResponse, String key)
throws IOException {

LiferayGlobalObjectConfiguration liferayGlobalObjectConfiguration =
_getLiferayGlobalObjectConfiguration(httpServletRequest);

PrintWriter printWriter = httpServletResponse.getWriter();

printWriter.print("<script");
Expand All @@ -107,7 +115,8 @@ public void include(
_renderLiferayPortlet(sb);
_renderLiferayPortletKeys(sb);
_renderLiferayPropsValues(httpServletRequest, sb);
_renderLiferayThemeDisplay(httpServletRequest, sb);
_renderLiferayThemeDisplay(
httpServletRequest, liferayGlobalObjectConfiguration, sb);
_renderLiferayUtil(sb);

_renderValue(
Expand Down Expand Up @@ -210,6 +219,35 @@ else if (dayIndex < monthIndex) {
return dateFormatPattern;
}

private LiferayGlobalObjectConfiguration
_getLiferayGlobalObjectConfiguration(
HttpServletRequest httpServletRequest) {

LiferayGlobalObjectConfiguration liferayGlobalObjectConfiguration;

long companyId = _portal.getCompanyId(httpServletRequest);

try {
liferayGlobalObjectConfiguration =
_configurationProvider.getCompanyConfiguration(
LiferayGlobalObjectConfiguration.class, companyId);
}
catch (ConfigurationException configurationException) {
if (_log.isWarnEnabled()) {
_log.warn(
"Using default configuration for company " + companyId,
configurationException);
}

liferayGlobalObjectConfiguration =
ConfigurableUtil.createConfigurable(
LiferayGlobalObjectConfiguration.class,
Collections.emptyMap());
}

return liferayGlobalObjectConfiguration;
}

private void _renderLiferayAUI(
HttpServletRequest httpServletRequest, StringBundler sb) {

Expand Down Expand Up @@ -499,7 +537,9 @@ private void _renderLiferayPropsValues(
}

private void _renderLiferayThemeDisplay(
HttpServletRequest httpServletRequest, StringBundler sb)
HttpServletRequest httpServletRequest,
LiferayGlobalObjectConfiguration liferayGlobalObjectConfiguration,
StringBundler sb)
throws PortalException {

sb.append("ThemeDisplay: {\n");
Expand Down Expand Up @@ -581,8 +621,11 @@ private void _renderLiferayThemeDisplay(
_renderMethod("getPlid", sb, themeDisplay.getPlid());
_renderMethod("getPortalURL", sb, themeDisplay.getPortalURL());
_renderMethod("getRealUserId", sb, themeDisplay.getRealUserId());
_renderMethod("getRemoteAddr", sb, themeDisplay.getRemoteAddr());
_renderMethod("getRemoteHost", sb, themeDisplay.getRemoteHost());

if (!liferayGlobalObjectConfiguration.disableGetRemoteMethods()) {
_renderMethod("getRemoteAddr", sb, themeDisplay.getRemoteAddr());
_renderMethod("getRemoteHost", sb, themeDisplay.getRemoteHost());
Copy link
Collaborator

@dsanz dsanz Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to omit the function or add one that returns undefined or just ''?

Subtle difference but important from the caller perspective.

Is there a "preferred" way to make client code better prepared to handle this scenario?

Copy link
Collaborator Author

@izaera izaera Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would remove or at least return undefined, because if we return '' we can mask errors (with undefined too but the probability is a bit smaller).

However, since in the end we will be removing/deprecating as much as we can from the Liferay object I'd say I'm more keen on removing the method. That way we create incentives to stop using it.

Copy link
Collaborator

@dsanz dsanz Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we just agreed on emitting the method but with code that throws an exception so that caller knows what to do to enable it back

}

Group scopeGroup = themeDisplay.getScopeGroup();

Expand Down Expand Up @@ -751,6 +794,9 @@ else if (value instanceof String) {
@Reference
private AuthToken _authToken;

@Reference
private ConfigurationProvider _configurationProvider;

private final Map<Locale, String> _displayNames = new ConcurrentHashMap<>();

@Reference
Expand Down
2 changes: 1 addition & 1 deletion ...resources/com/liferay/frontend/js/web/internal/servlet/taglib/dependencies/liferay.js.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@

merge(target[key], source[key]);
}
else {
else {
Object.assign(target, { [key]: source[key] });
}
}
Expand Down
Loading