ActionResponse.sendRedirect fails on external sites

[Iñaki Bergara, modificado 6 Anos atrás.]

Hi,

I recently updated to liferay v7GA4 and I have noticed that portlet redirects towards external sites have stopped working. Not 100% sure it's the update that caused this but the timing matches and I can't think of anything else. I need to restore this functionality somehow.

Currently, when the redirect should happen the site appears to be loading continually, then I get an error message on the site itself "There was an unexpected error. Please refresh the current page." followed by "OopsIt looks like this is taking longer than expected". But I get nothing on the server logs.

The code I currently use is

response.sendRedirect("https://www.google.be");

(response being an ActionResponse). I've considered this being a new security feature since I work on https, but if so I need to bypass it or at least make an exception for certain sites. Maybe there is an alternative way of redirecting users from the portlet java classes?

Any help would be very much appreciated.

[David H Nebinger, modificado 6 Anos atrás.]

Well, the problem with this is that a portlet is supposed to render a fragment of a page, so a "redirect to external site" is really a broken view of what the portlet should be allowed to do.

With Liferay's use of Senna.js to fetch the fragment dynamically for localized page updates, that attempted redirect would likely cause all kinds of significant problems with the rendering engine.

So from your perspective, I get why you would believe this "broke" in the update to GA4, but I would argue that this was "fixed" as part of the update.

[Iñaki Bergara, modificado 6 Anos atrás.]

David H Nebinger:

Well, the problem with this is that a portlet is supposed to render a fragment of a page, so a "redirect to external site" is really a broken view of what the portlet should be allowed to do.

With Liferay's use of Senna.js to fetch the fragment dynamically for localized page updates, that attempted redirect would likely cause all kinds of significant problems with the rendering engine.

So from your perspective, I get why you would believe this "broke" in the update to GA4, but I would argue that this was "fixed" as part of the update.

Hey, it was not a bug, it was a feature! ...Pity I can't find that story about a user who used an overheating CPU to keep his coffee warm that exemplified how there will always be users that make use of bugs and will complain when they get fixed.

Still, I've been relying on that 'bug' for years now. As an example, I've got a portlet that features a number of products. Each of these products will have a full page dedicated to it, which may or may not be within my site. Also, I need to log every click on a product. I've implemented this by linking the products to an action url where I can log the cick, check where the product page is and redirect the user to it.

If I can't redirect users 'abroad', how would the proper implementation of such a functionality be?

[Jagan Mohan Jayaraman, modificado 6 Anos atrás.]

Also, if you're going to redirect out of your domain, you will need to set these in your portal-ext.properties:

redirect.url.security.mode=domain
redirect.url.domains.allowed=

Leave the latter blank to allow any external domain, or narrow it down to google.be if that is the only one you need.

TTFN,
Jagan.

[Iñaki Bergara, modificado 6 Anos atrás.]

Thanks for that, it should prove useful.

I had put another reply to David with some more info and some joking, but it appears like it's gotten swallowed somewhere or flagged as inappropriate, so I'll take the chance to thank him too.

[David H Nebinger, modificado 6 Anos atrás.]

Hmm, don't know what might have happened to the other response. I know Liferay uses spam filters, but I don't know what they classify or block...

[Iñaki Bergara, modificado 6 Anos atrás.]

I see my reply when I'm logged in yet I don't while signed out, so it must have been shadowblocked. Possibly due to using a slightly colorful epithet in reference to a user abusing a CPU overheating bug to keep the coffee warm; a story a heard once that I thought illustrates my position of complaining about bigfixing.

[Amos Fong, modificado 6 Anos atrás.]

Hi Iñaki,

It looks like guest view permissions were removed on that post for some reason. Probably you misclicked the permissions drop down (this option probably should be hidden) when posting the message.

I've fixed the permissions on it so it should be good now. FYI, as of now, we don't have a shadow ban feature
https://web.liferay.com/community/forums/-/message_boards/view_message/97384796/maximized#_19_message_97468573

[Iñaki Bergara, modificado 6 Anos atrás.]

I don't remember having messed around up with that, but I suppose I did. Thanks for fixing it.

Anyway, back to the point, I tested what Jagan was saying, and it is not helping. I actually was already using it, in fact. The "problem" is deeper than that, and I don't know how to tackle it. In fact, the scenarios where I would need this kind of functionality have just increased. Is there any way I can bring this functionality back?