Liferay Portal 7.4 CE GA101+ and Liferay DXP 7.4 Update 101+ and Liferay DXP 2024.Q1 are bundled with Elasticsearch 7.17.14 as the Sidecar server.

In addition, the Elasticsearch client libraries have also been upgraded to 7.17.14. Refer to the Breaking Changes notes below for more details how this may impact deployments.

This feature adds read-only support for all object fields types, making sure users are not able to update those fields from both the UI or APIs, only the system can through default values or actions for example.

Users can configure their fields between 3 options, read-only true, false, or conditional.

• Read-only false: normal fields that support input from users through the UI or API.
• Read-only true: fields that do not support inputs from users through the UI or API, only can be updated through the system, as actions and default value for example.

  • Read-only fields must be supported in views and layouts, in the layouts those read-only fields must be not editable.

• Read-only conditional: fields that by definition are read-only false, but that will throw exceptions in case the condition is true and the user can’t update that field. In this case, in the UI, the logic should run before the field is loaded, in the headless API, this validation is only made when the user sends the request.
  • The condition is built using expression builder.

Liferay AB Testing capabilities now helps customers save time by reassigning the traffic split based on the running test results. The dynamic traffic allocation ensures that the estimated winner variation gets more traffic, optimizing conversion in highly time-sensitive situations. 

Because WebDAV appears to be the only viable solution for remote documents access/editing for the moment and there is customer demand. WebDAV supports HTTP Basic and Digest auth. The latter requires us to store insecure hashes, because of protocol specifics.

Because we cannot change that nor remove WebDAV support, we will reduce the impact of a successful attack instead.

This is achieved by creating a separate strong password for Digest auth.

We achieve the “strong” characteristic through only allowing generation of passwords, based on UUIDs. This means when the hash is produced, it will also be stronger also, though not perfect.

To help users enrich their content, Liferay provides a new LXC service to serve videos to a wide audience out of the box. Content creators will be able to upload videos directly to Liferay and the new service will take care of generating different versions with several resolutions to adapt to user’s connection capabilities, together with automatic subtitles and AI powered auto-tagging based on the video content. Content creators will also be able to add manual subtitles to the videos in case the automatic ones don't fit the need.

LXC now provides anomaly detection to identify disruptions in the expected website traffic. 

Anomalies in traffic volume are detected through a comparison with historical data, taking into account seasonality. Users can also create alerts based on custom events and schedule notifications when thresholds in metrics are exceeded.

This feature empowers users to create content use cases on top of objects framework, allowing admins to enable localization for objects' entries text fields.

This feature addresses the inconvenience of not being able to remove specific entries from user invitation forms, enhancing the user experience for admin users who create these forms. It solves the problem of inefficient form management, allowing users to remove entries without starting over.

The feature enables users to remove entries from the invitation form by clicking a designated removal button, with a confirmation modal to prevent accidental removal.

This feature allows admin users to configure whether to send one email with everyone in copy or many emails individually to each email address.

Traditionally in Liferay, it has been hard to manage features deprecation because customers kept using the old features even if we announced deprecation and eventual replacements.

Now, we are able to better manage deprecation processes with the following changes:

• Features deprecation notice is increased from 6 months to 12 months. It applies to the Intended Functionality, as described in our Support Policy.
• Now, deprecated features might be kept inside a Deprecation Feature Flag during the deprecation period. These feature flags work as follows:
  • For upgrades, Deprecation Flags are active by default, therefore customers still see the deprecated feature. No disruption is perceived.
  • For new instances created, Deprecation Flag is inactive by default, therefore, the deprecated feature is hidden and it requires activation to be used. It prevents users from unconsciously using a deprecated feature.

• Deprecated features are identified in DXP with a new deprecation badge.

Now, users are able to fill out object entries in parts, allowing them to save data as draft and return at their convenience to complete.

Before this feature when somebody wanted to activate/deactivate a User they needed to have “Delete” permission. We created two new permissions called “Activate” and “Deactivate”. Users with “Delete” permission still able to activate/deactivate users.

We also created two new Headless-API endpoint:

/headless-admin-user/v1.0/user-accounts/by-status/${status}

Status can be either "active" or "inactive," allowing you to fetch users by their status.

 /headless-admin-user/v1.0/user-accounts/by-email-address/${emailAddress}

This endpoint lets you retrieve a user by their email address, regardless of their current status.

When “Manage Users” permission is added to an Account Admin, the Admin can invite, assign and create Users. We separated the “Invite User” permission so it can be used without providing the other permissions to the User.

This feature allows customers, who need more capabilities than what the out of the box Expression Builder provides, to add their custom validations in Objects framework without running their data through an external microservice.

Evolving the user experience when object validations fail specifying which information field end-users need to update.

Enabling this feature will allow users to dynamically populate fields using expressions with information created from data filled and provided by other fields.

In order to use supported JDK versions, we are upgrading to Gradle 7 to use newer JDK.

The integration of ChatGPT with our Web Content editor is now available OOTB.

We extended the Audit Log info on IMPERSONATION actions , ASSIGN/UNASSIGN events involving the role assignment of individual users and ASSIGN/UNASSIGN Role Assignment of Organizations/User Groups/Sites.