Liferay Portal 7.4 CE GA101+ and Liferay DXP 7.4 Update 101+ and Liferay DXP 2024.Q1 are bundled with Elasticsearch 7.17.14 as the Sidecar server.

In addition, the Elasticsearch client libraries have also been upgraded to 7.17.14. Refer to the Breaking Changes notes below for more details how this may impact deployments.

LXC now provides anomaly detection to identify disruptions in the expected website traffic. 

Anomalies in traffic volume are detected through a comparison with historical data, taking into account seasonality. Users can also create alerts based on custom events and schedule notifications when thresholds in metrics are exceeded.

Because WebDAV appears to be the only viable solution for remote documents access/editing for the moment and there is customer demand. WebDAV supports HTTP Basic and Digest auth. The latter requires us to store insecure hashes, because of protocol specifics.

Because we cannot change that nor remove WebDAV support, we will reduce the impact of a successful attack instead.

This is achieved by creating a separate strong password for Digest auth.

We achieve the “strong” characteristic through only allowing generation of passwords, based on UUIDs. This means when the hash is produced, it will also be stronger also, though not perfect.

This feature adds read-only support for all object fields types, making sure users are not able to update those fields from both the UI or APIs, only the system can through default values or actions for example.

Users can configure their fields between 3 options, read-only true, false, or conditional.

• Read-only false: normal fields that support input from users through the UI or API.
• Read-only true: fields that do not support inputs from users through the UI or API, only can be updated through the system, as actions and default value for example.

  • Read-only fields must be supported in views and layouts, in the layouts those read-only fields must be not editable.

• Read-only conditional: fields that by definition are read-only false, but that will throw exceptions in case the condition is true and the user can’t update that field. In this case, in the UI, the logic should run before the field is loaded, in the headless API, this validation is only made when the user sends the request.
  • The condition is built using expression builder.

When users access a site in a language different from their user profile language, the following Information message is shown:

Now administrators can configure if this message will show up or not from System or Instance. Go to Instance Settings > Pages > Friendly URL Redirection and check/uncheck the “Show Alternative Layout Friendly URL Message” option for the appropriate value.

This feature empowers users to create content use cases on top of objects framework, allowing admins to enable localization for objects' entries text fields.

This feature allows customers, who need more capabilities than what the out of the box Expression Builder provides, to add their custom validations in Objects framework without running their data through an external microservice.

Now, users are able to fill out object entries in parts, allowing them to save data as draft and return at their convenience to complete.