We refactored the way Liferay scripts were managed, so admins can define stricter policies like:

script-src '[$NONCE$]'; script-src-attr 'unsafe-inline';

Limitations: If a policy like the one above is configured, the parts of the product that uses a rich-text editor will not work correctly. Analyze your scenario to identify how strict your policy can be in order to make the solution work.

Now users can configure the values for the following properties from settings (system, instance or site settings):

• session.timeout.auto.extend
• session.timeout.auto.extend.offset

When the Upgrade Report is enabled, the output directory of the report can be configured with the new portal property upgrade.report.dir

If this property is not set, the upgrade report can be found in the default directory:

• portal-tools-db-upgrade-client/reports for the upgrade tool.
• {liferay-home}/reports if upgrade was executed on startup.

With this feature we extending the SCIM implementation with User Group un/provisioning as well with the User Group membership un/provisioning.