Problem in Session Sharing between Portlet and Servlet for shared variable

[Sushil Kumar Saini, modificado hace 11 años.]

Problem in Session Sharing between Portlet and Servlet when name of the variable starts with shared session attribute keyword.

Tried the session sharing between the life-ray portlet and servlet residing in the same war using the following configuration. And it worked in the liferay version 6.0.6 CE and older version but it is not working in the liferay version 6.1.1 CE GA2

Enable the Private portlet session by Adding the following tag in the liferay-portlet.xml
<private-session-attributes>true</private-session-attributes>

To share the session between portal and portlet. Define the shared session attribute in portal-ext.properties file by configuring the following property in the property file
session.shared.attributes= LIFERAY_SHARED_ , APP_SHARED_

In the portlet action set the variable to portlet session. to share that variable with the servlet.

public class XYZAction extends GenericPortlet {
....................

public void doView(RenderRequest request, RenderResponse response) throws PortletException {
// Get portlet session
PortletSession prtSession = request.getPortletSession();
// Read value of shared variable
String testvar = (String) prtSession.getAttribute("APP_SHARED_testvar", PortletSession.APPLICATION_SCOPE);

// set variable to portlet session to share with servlet . variable name starts with shared session attribute keyword
prtSession.setAttribute( "APP_SHARED_testvar", testvar , PortletSession.APPLICATION_SCOPE);

// set variable to portlet session to share with servlet. variable name doesn't start with shared session attribute keyword
prtSession.setAttribute( "testvar_withoutkeyword", testvar , PortletSession.APPLICATION_SCOPE);
}
.................
}

Read the variable in the servlet. And it is not available in servlet.

public class XYZServlet extends HttpServlet {
.................
public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException {
.................
HttpSession session = request.getSession(false);

// Read variable from the session . variable name starts with shared session attribute keyword
String testvar = (String) session.getAttribute("APP_SHARED_testvar");

// Returns the null value as in this case variable is not accessible
System.out.println("Value of the variable whose name starts with the shared session attribute key : "+testvar);

.................
}
.................
}

This problem is coming only for specific scenarios where name of the variable starts with shared session attribute defined in the property file otherwise variable is properly accessible from the servlet.

[John Carter, modificado hace 11 años.]

Sushil,
In the earlier version of liferay i.e. 6.0.6 the format of shared variable is LIFERAY_SHARED_NAMEORVARIABLE but if you check now in the newer version of liferay some key type value is added in the shared variable like LIFERAY_SHARED_AUTHENTICATION_TOKEN11101_NAMEORVARIABLE,may be this is the reason . not sure.

[Sushil Kumar Saini, modificado hace 11 años.]

Hi John,

Thanks for your reply. But to me, it seems this is not the reason.

[Sushil Kumar Saini, modificado hace 11 años.]

Compared source code of the liferay between v6.0.6 CE and v6.1.1 CE.

And found in the new version liferay has introduced new class com.liferay.portal.servlet.SharedSessionWrapper which is getting called internally when we are trying to set the variable in the portlet session in application scope in following manner.

prtSession.setAttribute( "APP_SHARED_testvar", "testvalue" , PortletSession.APPLICATION_SCOPE);

com.liferay.portal.servlet.SharedSessionWrapper class in having two session object portal session and portlet session. And whenever we are setting the variable in the session it checks... Is the name of the variable starts with the keyword present shared session attribute list. ... If yes, it sets that variable in the portal session .... if not, it sets that variable in portlet session .... And variable which are set in the portal session are not available in the servlet session...... And variables which are set in the portlet session are available in the servlet session......

While the earlier version liferay was using only one http session object to set the variables and whatever variables we sets in the session from portlet .... becomes available in the servlet session.

I am not sure is it a enhancement by the liferay or Is it a bug? As it is breaking the backward compatibility and not supporting the old behavior of liferay.

[Sushil Kumar Saini, modificado hace 11 años.]

Hi All, ... I got it working by modifying the life-ray source code...... I know it is not good to modify the liferay source code, will create problem in liferay upgrade. but i didn't find any other way to get it working.

Modified the following method in the com.liferay.portal.servlet.SharedSessionWrapper.java file (liferay version 6.1.1 CE GA2).

package com.liferay.portal.servlet;
...........................................
public class SharedSessionWrapper implements HttpSession {
..............................
public void setAttribute(String name, Object value) {
HttpSession session = getSessionDelegate(name);
session.setAttribute(name, value);

// FIXED : Added the below code to make the shared session variables
// available to http servlet session
if (containsSharedAttribute(name)) {
HttpSession httpSession = getSessionDelegate();
httpSession.setAttribute(name, value);
}
}
...........................
}
Also attached the updated source code file as attachment.

But still I would like to know if there is any better way to do it.

Thanks

[Davy Kamerbeek, modificado hace 11 años.]

I want to know if this issue applies to 6.1.2 EE... i'm trying to do the same --> Set object in session (within a hook) and access it via a portlet.

Results always in null... Sharing session vars between portlets is not an issue, this works. To be clear, the problem is when setting a session var in a hook and it's not accessible from within a portlet. Tried many different ways:

In hook (#2 different approaches):

• session.setAttribute("LIFERAY_SHARED_hooktoportlet", "hook to portlet");
• session.setAttribute("hooktoportlet", "hook to portlet");

In portlet (#2 different approaches):

• String test = (String) portletSession.getAttribute("LIFERAY_SHARED_hooktoportlet", PortletSession.APPLICATION_SCOPE);
• String test = (String) portletSession.getAttribute("hooktoportlet", PortletSession.APPLICATION_SCOPE);

I've tried all the combinations i could come up with. In the liferay-portlet.xml i've set <private-session-attributes>false</private-session-attributes> just to be sure.

[Sushil Kumar Saini, modificado hace 11 años.]

Hi Davy,

I haven't tried with 6.1.2 EE. But your problem looks little bit different from mine. Yeah session sharing between portlet is working fine.

But I am getting problem in session sharing between portlet and servlet. And it have two cases one is working fine,.. Problem is with the case 2.

Case:1 Name of the variable doesn't start with shared session attribute keyword. In this case variable is accessible from servlet.
--------------------------------------------------------------------------------------------------------------
#Setting parameter in portlet session
prtSession.setAttribute( "testvar_withoutkeyword", testvar , PortletSession.APPLICATION_SCOPE);

#Getting value of session variable in servlet
String testvar = (String) session.getAttribute("testvar_withoutkeyword");

Case:2 Name of the variable starts with shared session attribute keyword. In this case variable is not accessible from servlet.
--------------------------------------------------------------------------------------------------------------
#Setting parameter in portlet session
prtSession.setAttribute( "APP_SHARED_testvar", testvar , PortletSession.APPLICATION_SCOPE);

#Getting value of session variable in servlet
String testvar = (String) session.getAttribute("APP_SHARED_testvar");


In my case i got working by applying the fix in liferay source code. If you think your problem is similar you can try it by appliying the fix as described in the above post and see if it works for you.

[Sushil Kumar Saini, modificado hace 11 años.]

I have also created a jira ticket for it in liferay. following is the jira url.
http://issues.liferay.com/browse/LPS-30666

[Jaya Sharma, modificado hace 6 años.]

Hi,

i have got an issue after security scan Issue is "Trust Boundary violation" in the below line of code.
session .setAttribute("fileName",fileName);

i tried to validate file name using regex it didn't work,
String fileName = _request.getParameter("fileName");

Kindly help

[Manupoti Subrahmanyam, modificado hace 6 años.]

Please apply HtmlUtil.escape method to input paramter then it will work and see below example

session .setAttribute("fileName",HtmlUtil.escape(fileName));