LPS-39762

Hi Brian,

sending it again (the previous pull https://github.com/brianchandotcom/liferay-portal/pull/13995). 

The bug doesn't relate to deploying portlets. Currently it's possible to manipulate with p_p_id and inject a payload that triggers XSS, for example: [http://localhost:8080/group/control_panel/manage?p_p_lifecycle=0&p_p_state=maximized&p_p_mode=view&controlPanelCategory=my&p_p_id=2_INSTANCE_'">\<script>alert(1)\</script>](http://localhost:8080/group/control_panel/manage?p_p_lifecycle=0&p_p_state=maximized&p_p_mode=view&controlPanelCategory=my&p_p_id=2_INSTANCE_'">\<script>alert(1\)\</script>)

In combination with other issues ([LPS-39735](https://issues.liferay.com/browse/LPS-39735) ~ https://github.com/brianchandotcom/liferay-portal/pull/13753) this can happen not only in Control panel.

/cc @rotty3000

Thank you.