LPS-35331 XSS in portlet sharing