Liferay Faces Released With Liferay Portal 7.2 Support!

Liferay Faces Bridge Impl 4.1.3, Bridge Ext 5.0.4, Portal 3.0.4, Alloy 3.0.2, and Util 3.2.0 have been released with support for Liferay Portal 7.2! The release also includes compatibility with PrimeFaces 7.0 and Alberto Fernández’s RichFaces 4.6.8.ayg and security fixes for file upload DoS and stored XSS vulnerabilities! The release is compatible with Liferay Portal 7.0, 7.1, and 7.2. Go to liferayfaces.org to get the latest dependency configurations and archetype generate commands.

Note: Any JSF portlets relying on CDI by including Weld Servlet inside the portlet WAR’s WEB-INF/lib folder must include the -cdiannotations: header inside WEB-INF/liferay-plugin-package.properties in Liferay 7.1.3+, 7.1.10 DXP FP10+, 7.1.10.2 SP2+, and Liferay 7.2. See LPS-86824 for more details.

Liferay Faces Bridge Impl 4.1.3 Highlights

• DoS via large file upload - Fixed file upload validation checks for p:fileUpload, rich:fileUpload, alloy:inputFile, and ace:fileEntry.
• [FACES-3426] - Upgrade to PrimeFaces 7.0
• [FACES-3373] - Upgrade to albfernandez/richfaces 4.6.8.ayg
• [FACES-3430] - Upgrade to Alloy 3.0.2
• [FACES-3352] - Upgrade to IceFaces 4.3.0
• [FACES-3353] - Upgrade to BootsFaces 1.4.1
• [FACES-3354] - Upgrade to ButterFaces 2.1.25
• [FACES-3427] - Upgrade to Mojarra 2.2.19

Full Release Notes

Liferay Faces Bridge Ext 5.0.4 Highlights

• [FACES-3432] - Support Liferay 7.2
• [FACES-3404] - Encoded URL characters are double encoded for certain Liferay Portal parameters causing features like user impersonation to fail

Full Release Notes

Liferay Faces Alloy 3.0.2 Highlights

• Stored XSS in Alloy components rendering JavaScript arrays of strings: alloy:autoComplete and alloy:inputFile (also fixed in Alloy 2.0.2)
• [FACES-3274] - Browser autocomplete box appears over alloy:inputDate, alloy:inputTime, and alloy:autoComplete
• [FACES-3413] - alloy:autoComplete not styled correctly in Liferay 7.1+

Full Release Notes

Liferay Faces Portal 3.0.4 Highlights

• [FACES-3178] - all characters are counted as plain text when portal:inputRichText bbcode and creole modes are used
• [FACES-3441] - portal:captcha ReCaptcha fails to render on ajax on Liferay 7.0 + FP81
• [FACES-3443] - portal:inputSearch fails to render on Ajax on Liferay 7.0 + FP 81
• [FACES-3442] - Refactor PortalTagRenderer API to make it more resilient to JSP tag changes

Known issues:

• [FACES-3453] - portal:inputRichText fails to render on Ajax request if render=”false” on initial request
• [FACES-3447] - portal:inputRichText reverts to HTML editor on Ajax re-render
• [FACES-3446] - portal:inputSearch scripts fail due to JavaScript error on Liferay 7.0 + FP 81

Full Release Notes

Liferay Faces Util 3.2.0 Highlights

• [FACES-3234] - Deprecate FacesRequestContext and replace with FacesContextHelperUtil.addScripts()
• [FACES-3238] - Util’s PORTLET_API incorrectly reports Portlet 2.1 API version as 1.0 when running in Liferay 7.0 GA5 causing BridgeDependencyVerifier error message

Full Release Notes

Archetypes

Along with these updates, all of our archetypes have been updated to the latest appropriate Liferay Faces artifacts, third-party libraries, and Mojarra 2.2.19.

Please report any issues with this new release in JIRA and ask any questions in our forums.