The migrated 6.2 pages reference the portlet by its bare id, without an
_INSTANCE_ suffix, and Liferay 7.4 does not render an instanceable portlet
placed that way: the page column stayed empty. Set
com.liferay.portlet.instanceable=false, as the 6.2 portlet was.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AGENTS.md gives coding agents the module-specific build/deploy commands,
Maven status, dependencies, structure and pitfalls (verified 2026-09-29).
README.md keeps the gCube template and adds a Usage section for portal
users/administrators, a Development section and the Liferay 6.2 repository
and reference commit the module was ported from.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dependencies on the workspace's core modules must use their canonical Maven
GAVs (docs/migration/mappings/migration_status_table.md, maven-portal-bom
5.0.0-SNAPSHOT), not the Gradle project/directory names:
- org.gcube.vomanagement:portal-manager (not portal-manager-core)
- org.gcube.vomanagement:usermanagement:3.0.0-SNAPSHOT (not
portal-usermanagement-core:1.0.0-SNAPSHOT)
- org.gcube.portal:shared-wrapper (not portal-gcube-shared-wrapper)
Explicit 1.0.0-SNAPSHOT versions on these are corrected to 3.0.0-SNAPSHOT;
versionless ones resolve through maven-portal-bom. Gradle build unaffected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GetOAuthTempCodeMVCResourceCommand issued an OAuth temp code for any
clientId/redirectURI pair supplied in the request, with no check against
what's actually registered - an open redirect / arbitrary token issuance
hole. It now validates clientId via getAuthorisedApplicationInfoFromIs
and redirectURI against getAuthorisedRedirectURLsFromIs, rejecting with
an error AuthorizationBean otherwise.
See ai_reports/portlet_bug_review.md, module 27.
Alfredo Oliviero
Federico Ruperti