PortalUtil.getUserPassword(httpRequest) API returns null

[Chad Allen, geändert vor 13 Jahren.]

The following scenario was working in 6.0.1, but after upgrading to 6.0.4 GA, the behavior is different.

Scenario - using an SDK hook, I am adding a custom LoginPostAction class to the login.events.post property in portal.properties. The custom action calls into PortalUtil.getUserPassword(request) to retrieve the user password typed into the sign-in portlet.

In 6.0.1, it returned the password, as it was typed in. However, in 6.0.4, the getUserPassword() call returns null.

Does anyone have an idea as to what may have changed here?

Thanks-

[Chad Allen, geändert vor 13 Jahren.]

Has anyone else run into this, or been able to confirm my findings? Is this the right place to post such queries?

[Dave Godbey, geändert vor 13 Jahren.]

I updated from Liferay 5.2.3 to 6.0.5. Between these two versions, I can corroborate what you have observed. I hope they plan to fix this, otherwise I'm going to need to find another way to get the password.

What would be better is if there was a way to insert a PortalPrincipal object during login.

[Dave Godbey, geändert vor 13 Jahren.]

I think I've figured this out. Looks like they decided allowing the password to propagate in the session was a security risk, and turn this off by default. Probably the right thing to do.

To turn back on the behavior of returning the password with PortalUtil, add this to your portal-ext.properties file:

session.store.password=true

[Chad Allen, geändert vor 13 Jahren.]

Thanks for your reply. This was very helpful.

[Jacob Caniparoli, geändert vor 12 Jahren.]

I am having the same problem in 6.0.11, did this solution work for you?