Is there a configuration to reduce or hide sensitive fields in ThemeDisplay when rendering to client?

Capabilities Security
1

Hello Liferay community,

I am working on a Liferay portal (e.g. version 7.4) and have observed that, when a page is rendered, the ThemeDisplay (or Liferay.ThemeDisplay in JS) includes many fields such as remoteAddr, userId, companyId, scopeGroupId, etc. Exposing some of these can impose security risks (e.g. information disclosure, enumeration, reconnaissance).

My goal is to limit or remove the more sensitive fields (for example, remoteAddr, realUserId, getUserId,getSiteAdminURL) while still preserving fields that client extensions, JavaScript, or fragments might depend on (such as getCompanyId(), getScopeGroupId(), portalURL, languageId, etc.).

My questions:

  1. Are there built-in configurations (portal-properties, module settings, theme config, etc.) in Liferay that allow hiding or filtering certain fields in ThemeDisplay when rendering to HTML / JavaScript?

  2. If there is no built-in option, has anyone implemented examples or patterns (override JSP / FreeMarker / hook / servlet filter) to sanitize or strip sensitive fields from ThemeDisplay? If so, could you share sample code or approaches?

  3. Would such modifications break or interfere with client extensions, fragments, or Liferay’s JS APIs? What pitfalls should one watch out for?

Thank you in advance for any insights or experience you can share!

Picture1
Picture1576×400 122 KB

2

The examples that you name aren’t really that secret, or even problematic:

remoteAddr: revealing a user’s IP address to that same user is nothing to keep secret from them. They likely already know their own IP address. Or if they’re connecting through a proxy, that’s also on their end.

realUserId, getUserId: again, this is the id of the accessing user. It might also be contained as key in their account settings etc.

getSiteAdminURL: This is more or less a Liferay-specific URL. So if you can’t get it from ThemeDisplay, you can get it from any other Liferay instance, so you’d not be hiding any information that is truly secret.