juliocamarero/liferay-portal — pull request #527 by KocsisDaniel (2012-08-22 11:30:51+00:00)
Title: [TECH SUPPORT] LPS-29341

Hi Julio,

this pr is to fix security issue with message boards reply to functionality. Currently it is possible to manipulate the parentMessageId, threadId, categoryId attributes after the request sent to the server and we are not checking any of them later. The fix strongly relies on the parentMessage (which is the message the user started to reply) threadId, categoryId and groupId should be the same with the ones where we want to put the new reply message.

Please let me know your opinion about the solution!
Thanks,
Daniel