{"action":"created","issue":{"url":"https://api.github.com/repos/brianchandotcom/liferay-portal/issues/35357","repository_url":"https://api.github.com/repos/brianchandotcom/liferay-portal","labels_url":"https://api.github.com/repos/brianchandotcom/liferay-portal/issues/35357/labels{/name}","comments_url":"https://api.github.com/repos/brianchandotcom/liferay-portal/issues/35357/comments","events_url":"https://api.github.com/repos/brianchandotcom/liferay-portal/issues/35357/events","html_url":"https://github.com/brianchandotcom/liferay-portal/pull/35357","id":130634498,"number":35357,"title":"LPS-62533 DoS on ResourcePermission records using ppid","user":{"login":"topolik","id":148147,"avatar_url":"https://avatars.githubusercontent.com/u/148147?v=3","gravatar_id":"","url":"https://api.github.com/users/topolik","html_url":"https://github.com/topolik","followers_url":"https://api.github.com/users/topolik/followers","following_url":"https://api.github.com/users/topolik/following{/other_user}","gists_url":"https://api.github.com/users/topolik/gists{/gist_id}","starred_url":"https://api.github.com/users/topolik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/topolik/subscriptions","organizations_url":"https://api.github.com/users/topolik/orgs","repos_url":"https://api.github.com/users/topolik/repos","events_url":"https://api.github.com/users/topolik/events{/privacy}","received_events_url":"https://api.github.com/users/topolik/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-02T10:05:38Z","updated_at":"2016-02-03T07:51:11Z","closed_at":"2016-02-03T06:36:24Z","pull_request":{"url":"https://api.github.com/repos/brianchandotcom/liferay-portal/pulls/35357","html_url":"https://github.com/brianchandotcom/liferay-portal/pull/35357","diff_url":"https://github.com/brianchandotcom/liferay-portal/pull/35357.diff","patch_url":"https://github.com/brianchandotcom/liferay-portal/pull/35357.patch"},"body":"Hi Brian,\r\n\r\nhttps://issues.liferay.com/browse/LPS-62533\r\n\r\n**Problem**: Chicken and egg :) \r\n\r\nTo check permissions we need to add them. So we add them during the first time render, however we need them before the render. So we add them every time somebody requests them => changing ppid in URL will create any number of records in DB.\r\n\r\n**Solution:** Create a \"default\" company-wide set of ResourcePermission records for a portlet.\r\n\r\nWhen we place a portlet on a page we add a default set of ResourcePermission records. If we place a portlet 20 times on the same page, there will be 20 sets with the same records (only primKey differs).\r\n\r\nSo instead of creating the set for every portlet instance we use the default records.\r\n\r\nWhen admin changes permissions of a portlet on page then a new set of permissions is created, as it was before.\r\n\r\n**TL;DR**: Before - every portlet on a page had own set of ResourcePermission records. After this pull - portlet has own set of ResourcePermission records only when they are different from the default set.\r\n\r\n/cc @JorgeFerrer "},"comment":{"url":"https://api.github.com/repos/brianchandotcom/liferay-portal/issues/comments/179072233","html_url":"https://github.com/brianchandotcom/liferay-portal/pull/35357#issuecomment-179072233","issue_url":"https://api.github.com/repos/brianchandotcom/liferay-portal/issues/35357","id":179072233,"user":{"login":"JorgeFerrer","id":868032,"avatar_url":"https://avatars.githubusercontent.com/u/868032?v=3","gravatar_id":"","url":"https://api.github.com/users/JorgeFerrer","html_url":"https://github.com/JorgeFerrer","followers_url":"https://api.github.com/users/JorgeFerrer/followers","following_url":"https://api.github.com/users/JorgeFerrer/following{/other_user}","gists_url":"https://api.github.com/users/JorgeFerrer/gists{/gist_id}","starred_url":"https://api.github.com/users/JorgeFerrer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JorgeFerrer/subscriptions","organizations_url":"https://api.github.com/users/JorgeFerrer/orgs","repos_url":"https://api.github.com/users/JorgeFerrer/repos","events_url":"https://api.github.com/users/JorgeFerrer/events{/privacy}","received_events_url":"https://api.github.com/users/JorgeFerrer/received_events","type":"User","site_admin":false},"created_at":"2016-02-03T07:51:11Z","updated_at":"2016-02-03T07:51:11Z","body":"Hey Brian,\r\n\r\nAfter our conversation I've noticed that in the XML we do have the concept of \"root\" associated to a model resource. See for example the following snipper:\r\n```\r\n\t<model-resource>\r\n\t\t<model-name>com.liferay.portlet.messageboards</model-name>\r\n\t\t<portlet-ref>\r\n\t\t\t<portlet-name>com_liferay_message_boards_web_portlet_MBAdminPortlet</portlet-name>\r\n\t\t\t<portlet-name>com_liferay_message_boards_web_portlet_MBPortlet</portlet-name>\r\n\t\t</portlet-ref>\r\n\t\t<root>true</root>\r\n\t\t<weight>1</weight>\r\n```\r\n"}}