Liferay page without header and menu

[Micael Ericsson, geändert vor 10 Jahren.]

I am developing a small site with some pages populated with my portlets.

One of the portlets/pages ( result presentation portlet) should be a part of another site. My page should be displayed within a certain part of a specific page in that site. I have a boundary to fit the report within. My sites settings, such as theme, header, menu, login etc should not be visible in this specific page. Adjusting theme for this single page to adopt the parent site css is not a problem.

But how do I display only my portlet area in the other site? None of my sites header, menu, login link etc should be visible.

[Juan Gonzalez, geändert vor 10 Jahren.]

Hi Micael,

maybe you want to embed your portlets or configure and use WSRP.

[Micael Ericsson, geändert vor 10 Jahren.]

Juan Gonzalez:

Hi Micael,

maybe you want to embed your portlets or configure and use WSRP.

I don't think these suggestions will work.
The other system is a .net based system. I can't include any of my code nor a WSRP. The only thing I can do is include a URL to a page on my site. I hope this explains what I want to do.

[Krzysztof Gołębiowski, geändert vor 10 Jahren.]

Maybe you can use the widget mechanism. Go to your portlet, open configuration and go to Sharing -> Any website. There is a javascript that should be put on the other website (but I think you can try to use provided url in iframe on destination system). Personally I haven't used this solution in production (but I always wanted to try ), we have done once an "iframe integration" but that was simply a page with blank theme containing our portlet.

Regards,
KG

[Micael Ericsson, geändert vor 10 Jahren.]

Krzysztof Gołębiowski:

Maybe you can use the widget mechanism. Go to your portlet, open configuration and go to Sharing -> Any website. There is a javascript that should be put on the other website (but I think you can try to use provided url in iframe on destination system). Personally I haven't used this solution in production (but I always wanted to try ), we have done once an "iframe integration" but that was simply a page with blank theme containing our portlet.

Regards,
KG

This sounds like the perfect solution for me.
I gave it a little try. From my site (which still is localhost only) I copied the script my portlets configuration presented for sharing:

<script src="http://localhost:8080/html/js/liferay/widget.js" type="text/javascript"></script>
<script type="text/javascript">
	Liferay.Widget({ url: 'http://localhost:8080/widget/web/guest/admin/-/AdHgAdmin_WAR_AdHgAdmin10SNAPSHOT'});
</script>

For a simple test I created a test.html file and copied this code inside standard html, body tag.

<h1>Test</h1>
<script src="http://localhost:8080/html/js/liferay/widget.js" type="text/javascript"></script>
<script type="text/javascript">
	Liferay.Widget({ url: 'http://localhost:8080/widget/web/guest/admin/-/AdHgAdmin_WAR_AdHgAdmin10SNAPSHOT'});
</script>
End

 

Then I opened this with my web browser. My hope was that the portlet should be loaded with this html page. Since it's all javascript client code.
"Test" and "End" was shown with a number of blank row in between, but no portlet data.

Perhaps it's not possible to test shareing in this way. Do I need to put this code on a server of some sort?

[Krzysztof Gołębiowski, geändert vor 10 Jahren.]

I tested this code and in fact it does not work (but I think it used to work in the past).

When I run this code, browser console displays the following error:

Refused to display 'http://host/widget/web/guest/home/-/56_INSTANCE_TtFG4Bd9fkkh' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

I read that X-Frame-Options was introduced recently (2010/11) to prevent vulnerabilities that were caused by "iframing" content. Basically option SAMEORIGIN says that this content can be iframed only on a website with the same domain as origin (http://tools.ietf.org/html/rfc7034#section-2.1). I tested this and put this snippet under the same domain - IFrame with my portlet has been loaded without any problems.

I think this may be and old functionality in Liferay, possibly it was introduced before X-Frame-Options header and it has not been adapted yet (and at the same time, Tomcat/Liferay automatically appends this header to all requests preventing all iframe vulnerabilities). Anyway, I've seen this is managed by separate servlet com.liferay.portal.servlet.WidgetServlet so I think it should be easy to override with ext or servlet filter hook.

I tested this on Liferay 6.2, maybe older versions behave in different way.

Regards,
KG

[Juan Gonzalez, geändert vor 10 Jahren.]

Hi Krzysztof,

you're right. That is a security improvement made in 6.2 to use that browser security check. I guess this code should work for Firefox or IE, but not for Chrome.

[Krzysztof Gołębiowski, geändert vor 10 Jahren.]

Thanks Juan, I created new jira issue for this case: https://issues.liferay.com/browse/LPS-45611.

[Juan Gonzalez, geändert vor 10 Jahren.]

Great,

please can you check what browsers are affected with this problem?

Thanks

[Juan Gonzalez, geändert vor 10 Jahren.]

You can disable that check by changing this property in portal-ext.properties:

http.header.secure.x.frame.options=false

[Tomáš Polešovský, geändert vor 10 Jahren.]

Hi Krzysztof,

put in your portal-ext.properties:

http.header.secure.x.frame.options.1=/widget/web/guest/home/-/56_INSTANCE_TtFG4Bd9fkkh

Or to allow all widgets from the home page:

http.header.secure.x.frame.options.1=/widget/web/guest/home/-/

This should help.

[Krzysztof Gołębiowski, geändert vor 10 Jahren.]

Hi Tomáš,
Thank you very much, I've learned something new about 6.2. I think this is also the answer for Micael's question.

Regads,
KG

[Micael Ericsson, geändert vor 10 Jahren.]

Thanks Thomas. This solved my problem and gave me a perfect solution.

[Krzysztof Gołębiowski, geändert vor 10 Jahren.]

Micael, one more thing. If you start using widgets, you could write few words about them in this thread (if there were any problems or you had some specific observations). As I wrote before, I always knew about that functionality but I never used it in production

Thanks in advance,
KG

[Kalpana P, geändert vor 10 Jahren.]

Hi Tomáš,

Is it possible to disable X-Frame-Options to only one page where that can be embedded in any website? Thanks in advance........

[Tomáš Polešovský, geändert vor 10 Jahren.]

Kalpana P:

Hi Tomáš,

Is it possible to disable X-Frame-Options to only one page where that can be embedded in any website? Thanks in advance........

Hi,

the syntax is similar / the same. Having a page with URL "/iframe-able", put in your portal-ext.properties:

http.header.secure.x.frame.options.1=/iframe-able

[Markus Wiche, geändert vor 8 Jahren.]

Hi Thomas,

did you try if this works in "Liferay Portal Community Edition 6.2 CE GA5".
For me this doesn'r work. I tried all the options written in this thread.

As i can see the Portal Properties have been loaded.

Thanks, Markus

[Pina Springer, geändert vor 8 Jahren.]

Hi to all,

the option http.header.secure.x.frame.options.1 etc. have to be in the system-ext.properties and NOT in portal-ext.properties.
This worked for me.

Best wishes,
Pina

[强 邓, geändert vor 7 Jahren.]

good!!!

[Mohammad Azharuddin, geändert vor 8 Jahren.]

HI Tomas

But when we open popup for configuration.. Again it is blocking ..

Look And Feel option is working.. But not the configuration

[Rajaneesh Kethavarapu, geändert vor 6 Jahren.]

HI Thomas as you explained I tried by copying my script tags into a sample HTML file

<script src="http://localhost:8080/html/js/liferay/widget.js" type="text/javascript"></script>
<script type="text/javascript">
	Liferay.Widget({ url: 'http://localhost:8080/widget/web/guest/home/-/customerinformation_WAR_ReviewRatingportlet'});
</script>


<h1>This is a Heading</h1>

and in portlet-ext properties, I tried independently by keeping properties
http.header.secure.x.frame.options.1=/widget/web/guest/home
http.header.secure.x.frame.options.1=/widget/web/guest/home/-/
http.header.secure.x.frame.options=false

But nothing worked for me I am still getting below error

Refused to display 'http://localhost:8080/widget/web/guest/home/-/customerinformation_WAR_ReviewRatingportlet' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
widget.js:13 GET http://localhost:8080/widget/web/guest/home/-/customerinformation_WAR_ReviewRatingportlet net::ERR_BLOCKED_BY_RESPONSE

Please give your suggestion