[#UP-2021] PortletSessions are not invalidated when the portal's session is invalidated

uPortal

PortletSessions are not invalidated when the portal's session is invalidated

Created: 16/Apr/08 05:48 PM Updated: 18/Apr/08 10:52 AM

Component/s:

Portlet Container

Affects Version/s:

3.0.0-M5, 3.0.0-RC2, 3.0.0-RC3

Fix Version/s:

3.0.0

Original Estimate:

Unknown

Remaining Estimate:

Unknown

Time Spent:

Unknown

Description

« Hide

This security related issue was addressed in 2.6 by ~~UP-1590~~ and had not yet been addressed for Pluto 1.1 in uPortal 3

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Eric Dalquist [16/Apr/08 05:52 PM]

Added a class that implements PortletInvocationListener and ApplicationListener. In PortletInvocationListener.onEnd if a PortletSession exists for the request a reference is added to the portal's HttpSession. In ApplicationListener.onApplicationEvent for a HttpSessionDestroyedEvent all PortletSessions in the destroyed HttpSession are invalidated.