brianchandotcom/liferay-portal — pull request #21233 by samuelkong (2014-09-25 08:32:46+00:00)
Title: LPS-50325 Arbitrary code execution

Brian,

This is essentially the same code that use to be in the portal (LPS-14726). However, it was rollback because it was decided that we should use permission to control who can add the XSL Content portlet.

Tomas (@topolik) and I revisited this issue and decided that permission isn't good enough. Even if a user has permission to use the XSL Content portlet, we shouldn't allow the user to execute *any* code they want.

Same issues also applies the web content templates, so it's also fixed here.

Also, doing a partial rollback of LPS-49451 since it's not needed after this.