Jen realized today playing in the 3-RC3 quickstart that if a portlet allows guest users to change portlet preferences these are persisted for the guest user and shared between all guest users. We're pretty sure this same behavior exists in 2.X as well. Since we have a portlet with preferences on the guest layout in 3.0 we're going to work out a solution to the problem as follows.

The PortletPreferencesServiceImpl will have some additional options available via bean properties; first to just not store portlet prefs for guest users, second to store them in the guest user's session so they are scoped and disappear at the end of their session, third to leave the functionality as is.

If this sounds reasonable I'm also wondering how we define who a guest is. Should the code check IPerson.isGuest() or IPerson.getSecurityContext().isAuthenticated()?

-Eric

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Reply via email to