RE: Security Patch - How to Source Code Patch?

thumbnail
Fredi B, modified 5 Years ago. Junior Member Posts: 69 Join Date: 4/1/20 Recent Posts
Good Morning Liferay Community,

I recently wanted to patch my Liferay Portal CE 7.1.3 GA4 with the corresponding security-patch published by Samuel Kong here: https://liferay.dev/blogs/-/blogs/security-patches-for-liferay-portal-6-2-7-0-and-7-1
Sadly the also given link to how to patch Liferay was not that much helpful... https://portal.liferay.dev/learn/security/patching
My 7.1.3 local portal is installed by official liferay CDN, same for our develop environment and the future productive environment of the customer.

Can somebody give me some more steps/hints I need to follow to secure these instances with newest patch?
1. I need to clone the Liferay Portal 7.1.3 GA4 from github
2. I need to apply the patch to this git project.
3. ??? How to go on from this step? What software do I need to compile and generate binaries?
4. ??? How can i apply this specific binary to the servers?

Thank You,
Fredi
thumbnail
Fredi B, modified 5 Years ago. Junior Member Posts: 69 Join Date: 4/1/20 Recent Posts
After reading my post again I think it might be helpful to clarify some things...

1. I cloned Liferay Portal CE 7.1.3 GA4
2. I applied the patch to the source code with git apply.

Now I am a little bit lost...I found a quite old guide from liferay leading me towards Ant, Gradle and Blade CLI. 
When trying to follow the steps I hit a wall when running "ant compile install-portal-snapshots" - and I am even unsure if this is even the right way.
Some help, even small hints would be great!

Cheers,
Fredi
thumbnail
Fernando Fernandez, modified 5 Years ago. Expert Posts: 401 Join Date: 8/22/07 Recent Posts
Hi Fredi,
I never tried it myself but maybe this article can help: https://liferay.dev/blogs/-/blogs/getting-started-with-building-liferay-from-source
HTH
Fernando
thumbnail
Fredi B, modified 5 Years ago. Junior Member Posts: 69 Join Date: 4/1/20 Recent Posts
Thank you Fernando,
because this is an urgent problem for us I also worked late in the evening and found this resource.
But I still can't compile Liferay Source 7.1.3 GA4 with patch succesfully.
The whole process is unbelievable frustrating and the documentation is NON-EXISTANT in a little comment in provided link there is the information that you need to use Ant 1.9.x for successful compiling.
Even with JDK8, Ant 1.9.x and with ant all or ant clean all I run into errors after 30-50 MINUTES

Is building Liferay-Portal from source even possible for non-Liferay-members?
I am quite new to Liferay so please pardon this question: Is this always the same way for Liferay to fix security problems in older releases?

Greetings, 
an extremely frustrated Fredi 
FAILURE: Build failed with an exception.
     [exec]
     [exec] * What went wrong:
     [exec] Execution failed for task ':apps:commerce:commerce-product-type-virtual-order-content-web:compileJava'.
     [exec] > Compilation failed; see the compiler error output for details.
     [exec]
     [exec] * Try:
     [exec] Run with --info or --debug option to get more log output. Run with --scan to get full insights.
     [exec]
     [exec] * Exception is:
     [exec] org.gradle.api.tasks.TaskExecutionException: Execution failed for task ':apps:commerce:commerce-product-type-virtual-order-content-web:compileJava'.
     [exec]     at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeActions(ExecuteActionsTaskExecuter.java:110)
     [exec]     at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.execute(ExecuteActionsTaskExecuter.java:77)
     [exec]     at org.gradle.api.internal.tasks.execution.OutputDirectoryCreatingTaskExecuter.execute(OutputDirectoryCreatingTaskExecuter.java:51)
     [exec]     at org.gradle.api.internal.tasks.execution.SkipUpToDateTaskExecuter.execute(SkipUpToDateTaskExecuter.java:59)
     [exec]     at org.gradle.api.internal.tasks.execution.ResolveTaskOutputCachingStateExecuter.execute(ResolveTaskOutputCachingStateExecuter.java:54)
     [exec]     at org.gradle.api.internal.tasks.execution.ValidatingTaskExecuter.execute(ValidatingTaskExecuter.java:59)
     [exec]     at org.gradle.api.internal.tasks.execution.SkipEmptySourceFilesTaskExecuter.execute(SkipEmptySourceFilesTaskExecuter.java:101)
     [exec]     at org.gradle.api.internal.tasks.execution.FinalizeInputFilePropertiesTaskExecuter.execute(FinalizeInputFilePropertiesTaskExecuter.java:44)
     [exec]     at org.gradle.api.internal.tasks.execution.CleanupStaleOutputsExecuter.execute(CleanupStaleOutputsExecuter.java:91)
     [exec]     at org.gradle.api.internal.tasks.execution.ResolveTaskArtifactStateTaskExecuter.execute(ResolveTaskArtifactStateTaskExecuter.java:62)
     [exec]     at org.gradle.api.internal.tasks.execution.SkipTaskWithNoActionsExecuter.execute(SkipTaskWithNoActionsExecuter.java:59)
     [exec]     at org.gradle.api.internal.tasks.execution.SkipOnlyIfTaskExecuter.execute(SkipOnlyIfTaskExecuter.java:54)
     [exec]     at org.gradle.api.internal.tasks.execution.ExecuteAtMostOnceTaskExecuter.execute(ExecuteAtMostOnceTaskExecuter.java:43)
     [exec]     at org.gradle.api.internal.tasks.execution.CatchExceptionTaskExecuter.execute(CatchExceptionTaskExecuter.java:34)
     [exec]     at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.run(EventFiringTaskExecuter.java:51)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:300)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:292)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.execute(DefaultBuildOperationExecutor.java:174)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:90)
     [exec]     at org.gradle.internal.operations.DelegatingBuildOperationExecutor.run(DelegatingBuildOperationExecutor.java:31)
     [exec]     at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter.execute(EventFiringTaskExecuter.java:46)
     [exec]     at org.gradle.execution.taskgraph.LocalTaskInfoExecutor.execute(LocalTaskInfoExecutor.java:42)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareWorkItemExecutor.execute(DefaultTaskExecutionGraph.java:277)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareWorkItemExecutor.execute(DefaultTaskExecutionGraph.java:262)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskPlanExecutor$ExecutorWorker$1.execute(DefaultTaskPlanExecutor.java:135)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskPlanExecutor$ExecutorWorker$1.execute(DefaultTaskPlanExecutor.java:130)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskPlanExecutor$ExecutorWorker.execute(DefaultTaskPlanExecutor.java:200)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskPlanExecutor$ExecutorWorker.executeWithWork(DefaultTaskPlanExecutor.java:191)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskPlanExecutor$ExecutorWorker.run(DefaultTaskPlanExecutor.java:130)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskPlanExecutor.process(DefaultTaskPlanExecutor.java:74)
     [exec]     at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph.execute(DefaultTaskExecutionGraph.java:143)
     [exec]     at org.gradle.execution.SelectedTaskExecutionAction.execute(SelectedTaskExecutionAction.java:40)
     [exec]     at org.gradle.execution.DefaultBuildExecuter.execute(DefaultBuildExecuter.java:40)
     [exec]     at org.gradle.execution.DefaultBuildExecuter.access$000(DefaultBuildExecuter.java:24)
     [exec]     at org.gradle.execution.DefaultBuildExecuter$1.proceed(DefaultBuildExecuter.java:46)
     [exec]     at org.gradle.execution.DryRunBuildExecutionAction.execute(DryRunBuildExecutionAction.java:49)
     [exec]     at org.gradle.execution.DefaultBuildExecuter.execute(DefaultBuildExecuter.java:40)
     [exec]     at org.gradle.execution.DefaultBuildExecuter.execute(DefaultBuildExecuter.java:33)
     [exec]     at org.gradle.initialization.DefaultGradleLauncher$ExecuteTasks.run(DefaultGradleLauncher.java:355)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:300)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:292)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.execute(DefaultBuildOperationExecutor.java:174)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:90)
     [exec]     at org.gradle.internal.operations.DelegatingBuildOperationExecutor.run(DelegatingBuildOperationExecutor.java:31)
     [exec]     at org.gradle.initialization.DefaultGradleLauncher.runTasks(DefaultGradleLauncher.java:219)
     [exec]     at org.gradle.initialization.DefaultGradleLauncher.doBuildStages(DefaultGradleLauncher.java:149)
     [exec]     at org.gradle.initialization.DefaultGradleLauncher.executeTasks(DefaultGradleLauncher.java:124)
     [exec]     at org.gradle.internal.invocation.GradleBuildController$1.call(GradleBuildController.java:77)
     [exec]     at org.gradle.internal.invocation.GradleBuildController$1.call(GradleBuildController.java:74)
     [exec]     at org.gradle.internal.work.DefaultWorkerLeaseService.withLocks(DefaultWorkerLeaseService.java:154)
     [exec]     at org.gradle.internal.work.StopShieldingWorkerLeaseService.withLocks(StopShieldingWorkerLeaseService.java:38)
     [exec]     at org.gradle.internal.invocation.GradleBuildController.doBuild(GradleBuildController.java:96)
     [exec]     at org.gradle.internal.invocation.GradleBuildController.run(GradleBuildController.java:74)
     [exec]     at org.gradle.tooling.internal.provider.ExecuteBuildActionRunner.run(ExecuteBuildActionRunner.java:28)
     [exec]     at org.gradle.launcher.exec.ChainingBuildActionRunner.run(ChainingBuildActionRunner.java:35)
     [exec]     at org.gradle.tooling.internal.provider.ValidatingBuildActionRunner.run(ValidatingBuildActionRunner.java:32)
     [exec]     at org.gradle.launcher.exec.RunAsBuildOperationBuildActionRunner$3.run(RunAsBuildOperationBuildActionRunner.java:50)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:300)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:292)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.execute(DefaultBuildOperationExecutor.java:174)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:90)
     [exec]     at org.gradle.internal.operations.DelegatingBuildOperationExecutor.run(DelegatingBuildOperationExecutor.java:31)
     [exec]     at org.gradle.launcher.exec.RunAsBuildOperationBuildActionRunner.run(RunAsBuildOperationBuildActionRunner.java:45)
     [exec]     at org.gradle.tooling.internal.provider.SubscribableBuildActionRunner.run(SubscribableBuildActionRunner.java:51)
     [exec]     at org.gradle.launcher.exec.InProcessBuildActionExecuter$1.transform(InProcessBuildActionExecuter.java:47)
     [exec]     at org.gradle.launcher.exec.InProcessBuildActionExecuter$1.transform(InProcessBuildActionExecuter.java:44)
     [exec]     at org.gradle.composite.internal.DefaultRootBuildState.run(DefaultRootBuildState.java:79)
     [exec]     at org.gradle.launcher.exec.InProcessBuildActionExecuter.execute(InProcessBuildActionExecuter.java:44)
     [exec]     at org.gradle.launcher.exec.InProcessBuildActionExecuter.execute(InProcessBuildActionExecuter.java:30)
     [exec]     at org.gradle.launcher.exec.BuildTreeScopeBuildActionExecuter.execute(BuildTreeScopeBuildActionExecuter.java:39)
     [exec]     at org.gradle.launcher.exec.BuildTreeScopeBuildActionExecuter.execute(BuildTreeScopeBuildActionExecuter.java:25)
     [exec]     at org.gradle.tooling.internal.provider.ContinuousBuildActionExecuter.execute(ContinuousBuildActionExecuter.java:80)
     [exec]     at org.gradle.tooling.internal.provider.ContinuousBuildActionExecuter.execute(ContinuousBuildActionExecuter.java:53)
     [exec]     at org.gradle.tooling.internal.provider.ServicesSetupBuildActionExecuter.execute(ServicesSetupBuildActionExecuter.java:62)
     [exec]     at org.gradle.tooling.internal.provider.ServicesSetupBuildActionExecuter.execute(ServicesSetupBuildActionExecuter.java:34)
     [exec]     at org.gradle.tooling.internal.provider.GradleThreadBuildActionExecuter.execute(GradleThreadBuildActionExecuter.java:36)
     [exec]     at org.gradle.tooling.internal.provider.GradleThreadBuildActionExecuter.execute(GradleThreadBuildActionExecuter.java:25)
     [exec]     at org.gradle.tooling.internal.provider.ParallelismConfigurationBuildActionExecuter.execute(ParallelismConfigurationBuildActionExecuter.java:43)
     [exec]     at org.gradle.tooling.internal.provider.ParallelismConfigurationBuildActionExecuter.execute(ParallelismConfigurationBuildActionExecuter.java:29)
     [exec]     at org.gradle.tooling.internal.provider.StartParamsValidatingActionExecuter.execute(StartParamsValidatingActionExecuter.java:59)
     [exec]     at org.gradle.tooling.internal.provider.StartParamsValidatingActionExecuter.execute(StartParamsValidatingActionExecuter.java:31)
     [exec]     at org.gradle.tooling.internal.provider.SessionFailureReportingActionExecuter.execute(SessionFailureReportingActionExecuter.java:59)
     [exec]     at org.gradle.tooling.internal.provider.SessionFailureReportingActionExecuter.execute(SessionFailureReportingActionExecuter.java:44)
     [exec]     at org.gradle.tooling.internal.provider.SetupLoggingActionExecuter.execute(SetupLoggingActionExecuter.java:46)
     [exec]     at org.gradle.tooling.internal.provider.SetupLoggingActionExecuter.execute(SetupLoggingActionExecuter.java:30)
     [exec]     at org.gradle.launcher.cli.RunBuildAction.run(RunBuildAction.java:52)
     [exec]     at org.gradle.internal.Actions$RunnableActionAdapter.execute(Actions.java:207)
     [exec]     at org.gradle.launcher.cli.CommandLineActionFactory$ParseAndBuildAction.execute(CommandLineActionFactory.java:402)
     [exec]     at org.gradle.launcher.cli.CommandLineActionFactory$ParseAndBuildAction.execute(CommandLineActionFactory.java:375)
     [exec]     at org.gradle.launcher.cli.ExceptionReportingAction.execute(ExceptionReportingAction.java:37)
     [exec]     at org.gradle.launcher.cli.ExceptionReportingAction.execute(ExceptionReportingAction.java:23)
     [exec]     at org.gradle.launcher.cli.CommandLineActionFactory$WithLogging.execute(CommandLineActionFactory.java:368)
     [exec]     at org.gradle.launcher.cli.CommandLineActionFactory$WithLogging.execute(CommandLineActionFactory.java:298)
     [exec]     at org.gradle.launcher.Main.doAction(Main.java:36)
     [exec]     at org.gradle.launcher.bootstrap.EntryPoint.run(EntryPoint.java:45)
     [exec]     at org.gradle.launcher.bootstrap.ProcessBootstrap.runNoExit(ProcessBootstrap.java:60)
     [exec]     at org.gradle.launcher.bootstrap.ProcessBootstrap.run(ProcessBootstrap.java:37)
     [exec]     at org.gradle.launcher.GradleMain.main(GradleMain.java:23)
     [exec]     at org.gradle.wrapper.BootstrapMainStarter.start(BootstrapMainStarter.java:31)
     [exec]     at org.gradle.wrapper.WrapperExecutor.execute(WrapperExecutor.java:108)
     [exec]     at org.gradle.wrapper.GradleWrapperMain.main(GradleWrapperMain.java:61)
     [exec] Caused by: org.gradle.api.internal.tasks.compile.CompilationFailedException: Compilation failed; see the compiler error output for details.
     [exec]     at org.gradle.api.internal.tasks.compile.JdkJavaCompiler.execute(JdkJavaCompiler.java:52)
     [exec]     at org.gradle.api.internal.tasks.compile.JdkJavaCompiler.execute(JdkJavaCompiler.java:36)
     [exec]     at org.gradle.api.internal.tasks.compile.NormalizingJavaCompiler.delegateAndHandleErrors(NormalizingJavaCompiler.java:100)
     [exec]     at org.gradle.api.internal.tasks.compile.NormalizingJavaCompiler.execute(NormalizingJavaCompiler.java:52)
     [exec]     at org.gradle.api.internal.tasks.compile.NormalizingJavaCompiler.execute(NormalizingJavaCompiler.java:38)
     [exec]     at org.gradle.api.internal.tasks.compile.AnnotationProcessorDiscoveringCompiler.execute(AnnotationProcessorDiscoveringCompiler.java:49)
     [exec]     at org.gradle.api.internal.tasks.compile.AnnotationProcessorDiscoveringCompiler.execute(AnnotationProcessorDiscoveringCompiler.java:35)
     [exec]     at org.gradle.api.internal.tasks.compile.CleaningJavaCompilerSupport.execute(CleaningJavaCompilerSupport.java:39)
     [exec]     at org.gradle.api.internal.tasks.compile.incremental.IncrementalCompilerFactory$2.execute(IncrementalCompilerFactory.java:110)
     [exec]     at org.gradle.api.internal.tasks.compile.incremental.IncrementalCompilerFactory$2.execute(IncrementalCompilerFactory.java:106)
     [exec]     at org.gradle.api.internal.tasks.compile.incremental.IncrementalResultStoringCompiler.execute(IncrementalResultStoringCompiler.java:59)
     [exec]     at org.gradle.api.internal.tasks.compile.incremental.IncrementalResultStoringCompiler.execute(IncrementalResultStoringCompiler.java:43)
     [exec]     at org.gradle.api.tasks.compile.JavaCompile.performCompilation(JavaCompile.java:153)
     [exec]     at org.gradle.api.tasks.compile.JavaCompile.compile(JavaCompile.java:121)
     [exec]     at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:73)
     [exec]     at org.gradle.api.internal.project.taskfactory.IncrementalTaskAction.doExecute(IncrementalTaskAction.java:50)
     [exec]     at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:39)
     [exec]     at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:26)
     [exec]     at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter$1.run(ExecuteActionsTaskExecuter.java:131)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:300)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:292)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.execute(DefaultBuildOperationExecutor.java:174)
     [exec]     at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:90)
     [exec]     at org.gradle.internal.operations.DelegatingBuildOperationExecutor.run(DelegatingBuildOperationExecutor.java:31)
     [exec]     at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeAction(ExecuteActionsTaskExecuter.java:120)
     [exec]     at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeActions(ExecuteActionsTaskExecuter.java:99)
     [exec]     ... 100 more
     [exec]
     [exec]
     [exec] * Get more help at https://help.gradle.org
     [exec]
     [exec] BUILD FAILED in 13m 43s
     [exec] 987 actionable tasks: 928 executed, 59 up-to-date
     [exec]BUILD FAILED
C:\lpatch\liferay-portal\build.xml:117: The following error occurred while executing this line:
C:\lpatch\liferay-portal\build.xml:414: The following error occurred while executing this line:
C:\lpatch\liferay-portal\build-common.xml:899: C:\lpatch\liferay-portal\build-common.xml:901: exec returned: 1Total time: 37 minutes 58 seconds
thumbnail
David H Nebinger, modified 5 Years ago. Liferay Legend Posts: 14933 Join Date: 9/2/06 Recent Posts
Building from source is possible, but it is also delicate.

You should never build from github because that is always seen as a work in progress. Compiles might fail, tests might fail, etc.

It takes time and memory to compile, horsepower is helpful too in order to cut time. I'd also recommend skipping the tests, doing so will shorten the time and possibly eliminate the error you're hitting.
thumbnail
Fredi B, modified 5 Years ago. Junior Member Posts: 69 Join Date: 4/1/20 Recent Posts
David H Nebinger:

Building from source is possible, but it is also delicate.

You should never build from github because that is always seen as a work in progress. Compiles might fail, tests might fail, etc.

It takes time and memory to compile, horsepower is helpful too in order to cut time. I'd also recommend skipping the tests, doing so will shorten the time and possibly eliminate the error you're hitting.

Thanks to hear back from a Liferay Legend. emoticon
We currently use the 7.1.3-ga4 branch (that should not be work in progress?) and can confirm your statement about "memory and horsepower" - We currently hit problems with Java Heap Size even when using ANT_OPTS "-Xmx4440m"
thumbnail
Dominik Marks, modified 5 Years ago. Regular Member Posts: 149 Join Date: 8/29/12 Recent Posts
I was able to compile Liferay from source with ANT_OPTS="-Xmx4096m" and a 64-bit Java 8 JDK.
thumbnail
Fredi B, modified 5 Years ago. Junior Member Posts: 69 Join Date: 4/1/20 Recent Posts
Dominik Marks:

I was able to compile Liferay from source with ANT_OPTS="-Xmx4096m" and a 64-bit Java 8 JDK.
Wow, thank you! With these informations I also was able to compile from source...
Sadly, when starting the binary I get greeted by the 7.1.2 GA3 Hello World Portlet.

But checking the E-Mail Settings I can see fixes applied by the 7.1.3 GA4 patch:
+account-created-notification-body-with-password-reset-help=Enter the body of the email sent to users upon registration. This should contain a link to set a new password.

On startup there is also the 7.1.2 version in the logs: https://imgur.com/bnpyIyD
Is this als the case for you @Dominik Marks?
Would you provide your binary for 7.1.3?

Greetings, Fredi
thumbnail
David H Nebinger, modified 5 Years ago. Liferay Legend Posts: 14933 Join Date: 9/2/06 Recent Posts
That is expected, Fredi. Liferay updates typically don't touch the version message strings, it is just too hard to keep it accurate.