CVE-2017-12645

@@ -20,16 +20,20 @@
 import com.liferay.portal.kernel.util.HashMapDictionary;
 import com.liferay.portal.kernel.util.HttpUtil;
 import com.liferay.portal.kernel.util.MapUtil;
+import com.liferay.portal.test.log.CaptureAppender;
+import com.liferay.portal.test.log.Log4JLoggerTestUtil;
 import com.liferay.portal.test.rule.LiferayIntegrationTestRule;
 import com.liferay.portal.util.test.PortletContainerTestUtil;
 import com.liferay.portal.util.test.PortletContainerTestUtil.Response;
 import com.liferay.portlet.PortletURLImpl;
+import com.liferay.portlet.SecurityPortletContainerWrapper;
 
 import java.io.IOException;
 import java.io.PrintWriter;
 
 import java.util.Collections;
 import java.util.Dictionary;
+import java.util.List;
 import java.util.Map;
 
 import javax.portlet.PortletContext;
@@ -45,6 +49,9 @@
 
 import javax.servlet.http.HttpServletRequest;
 
+import org.apache.log4j.Level;
+import org.apache.log4j.spi.LoggingEvent;
+
 import org.junit.Assert;
 import org.junit.ClassRule;
 import org.junit.Rule;
@@ -63,6 +70,39 @@ public class RenderRequestPortletContainerTest
 	public static final AggregateTestRule aggregateTestRule =
 		new LiferayIntegrationTestRule();
 
+	@Test
+	public void testInvalidPortletId() throws Exception {
+		HttpServletRequest httpServletRequest =
+			PortletContainerTestUtil.getHttpServletRequest(group, layout);
+
+		String url =
+			layout.getRegularURL(httpServletRequest) +
+				"?p_p_id='\"><script>alert(1)</script>&p_p_lifecycle=0&" +
+					"p_p_state=exclusive";
+
+		try (CaptureAppender captureAppender =
+				Log4JLoggerTestUtil.configureLog4JLogger(
+					SecurityPortletContainerWrapper.class.getName(),
+					Level.WARN)) {
+
+			Response response = PortletContainerTestUtil.request(url);
+
+			List<LoggingEvent> loggingEvents =
+				captureAppender.getLoggingEvents();
+
+			Assert.assertEquals(
+				loggingEvents.toString(), 1, loggingEvents.size());
+
+			LoggingEvent loggingEvent = loggingEvents.get(0);
+
+			Assert.assertEquals(
+				"Invalid portlet ID '\"><script>alert(1)</script>",
+				loggingEvent.getMessage());
+
+			Assert.assertEquals(200, response.getCode());
+		}
+	}
+
 	@Test
 	public void testIsAccessGrantedByPortletAuthenticationToken()
 		throws Exception {

@@ -20,16 +20,20 @@
 import com.liferay.portal.kernel.util.HashMapDictionary;
 import com.liferay.portal.kernel.util.HttpUtil;
 import com.liferay.portal.kernel.util.MapUtil;
+import com.liferay.portal.test.log.CaptureAppender;
+import com.liferay.portal.test.log.Log4JLoggerTestUtil;
 import com.liferay.portal.test.rule.LiferayIntegrationTestRule;
 import com.liferay.portal.util.test.PortletContainerTestUtil;
 import com.liferay.portal.util.test.PortletContainerTestUtil.Response;
 import com.liferay.portlet.PortletURLImpl;
+import com.liferay.portlet.SecurityPortletContainerWrapper;
 
 import java.io.IOException;
 import java.io.PrintWriter;
 
 import java.util.Collections;
 import java.util.Dictionary;
+import java.util.List;
 import java.util.Map;
 
 import javax.portlet.PortletContext;
@@ -43,6 +47,9 @@
 
 import javax.servlet.http.HttpServletRequest;
 
+import org.apache.log4j.Level;
+import org.apache.log4j.spi.LoggingEvent;
+
 import org.junit.Assert;
 import org.junit.ClassRule;
 import org.junit.Rule;
@@ -61,6 +68,47 @@ public class ResourceRequestPortletContainerTest
 	public static final AggregateTestRule aggregateTestRule =
 		new LiferayIntegrationTestRule();
 
+	@Test
+	public void testInvalidPortletId() throws Exception {
+		HttpServletRequest httpServletRequest =
+			PortletContainerTestUtil.getHttpServletRequest(group, layout);
+
+		String layoutURL = layout.getRegularURL(httpServletRequest);
+
+		String url =
+			layoutURL +
+				"?p_p_id='\"><script>alert(1)</script>&p_p_lifecycle=2&";
+
+		try (CaptureAppender captureAppender =
+				Log4JLoggerTestUtil.configureLog4JLogger(
+					SecurityPortletContainerWrapper.class.getName(),
+					Level.WARN)) {
+
+			Response response = PortletContainerTestUtil.request(url);
+
+			List<LoggingEvent> loggingEvents =
+				captureAppender.getLoggingEvents();
+
+			Assert.assertEquals(
+				loggingEvents.toString(), 2, loggingEvents.size());
+
+			LoggingEvent loggingEvent = loggingEvents.get(0);
+
+			Assert.assertEquals(
+				"Invalid portlet ID '\"><script>alert(1)</script>",
+				loggingEvent.getMessage());
+
+			loggingEvent = loggingEvents.get(1);
+
+			Assert.assertEquals(
+				"Reject serveResource for " + layoutURL +
+					" on '\"><script>alert(1)</script>",
+				loggingEvent.getMessage());
+
+			Assert.assertEquals(400, response.getCode());
+		}
+	}
+
 	@Test
 	public void testIsAccessGrantedByPortletAuthenticationToken()
 		throws Exception {

@@ -1,79 +0,0 @@
-/**
- * Copyright (c) 2000-present Liferay, Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or modify it under
- * the terms of the GNU Lesser General Public License as published by the Free
- * Software Foundation; either version 2.1 of the License, or (at your option)
- * any later version.
- *
- * This library is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
- * details.
- */
-
-package com.liferay.portal.service;
-
-import com.liferay.portal.kernel.test.CaptureHandler;
-import com.liferay.portal.kernel.test.JDKLoggerTestUtil;
-import com.liferay.portal.kernel.test.ReflectionTestUtil;
-import com.liferay.portal.service.impl.PortletLocalServiceImpl;
-
-import java.lang.reflect.Method;
-
-import java.util.List;
-import java.util.logging.Level;
-import java.util.logging.LogRecord;
-
-import org.junit.Assert;
-import org.junit.Test;
-
-/**
- * @author Matthew Tambara
- */
-public class ValidPortletIdTest {
-
-	@Test
-	public void testIsValidPortletId() throws Exception {
-		Method method = ReflectionTestUtil.getMethod(
-			PortletLocalServiceImpl.class, "_checkValidPortletId",
-			String.class);
-
-		PortletLocalServiceImpl portletLocalServiceImpl =
-			new PortletLocalServiceImpl();
-
-		method.invoke(portletLocalServiceImpl, "aaa");
-		method.invoke(portletLocalServiceImpl, "AAA");
-		method.invoke(portletLocalServiceImpl, "123");
-		method.invoke(portletLocalServiceImpl, "aA1");
-		method.invoke(portletLocalServiceImpl, "aaa_bbb");
-		method.invoke(portletLocalServiceImpl, "aaa#bbb");
-
-		try (CaptureHandler captureHandler =
-				JDKLoggerTestUtil.configureJDKLogger(
-					PortletLocalServiceImpl.class.getName(), Level.WARNING)) {
-
-			try {
-				method.invoke(
-					portletLocalServiceImpl,
-					"2_INSTANCE_'\"><script>alert(1)</script>");
-
-				Assert.fail();
-			}
-			catch (Exception e) {
-			}
-
-			List<LogRecord> logRecords = captureHandler.getLogRecords();
-
-			Assert.assertEquals(logRecords.toString(), 1, logRecords.size());
-
-			LogRecord logRecord = logRecords.get(0);
-
-			Assert.assertEquals(
-				logRecord.toString(),
-				"Invalid portlet ID 2_INSTANCE_'\"><script>alert(1)</script>",
-				logRecord.getMessage());
-		}
-	}
-
-}
\ No newline at end of file

@@ -0,0 +1,51 @@
+/**
+ * Copyright (c) 2000-present Liferay, Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU Lesser General Public License as published by the Free
+ * Software Foundation; either version 2.1 of the License, or (at your option)
+ * any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
+ * details.
+ */
+
+package com.liferay.portlet;
+
+import com.liferay.portal.kernel.portlet.PortletContainer;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+/**
+ * @author Akos Thurzo
+ */
+public class SecurityPortletContainerWrapperTest {
+
+	@Test
+	public void testIsValidPortletId() {
+		PortletContainer portletContainer = new PortletContainerImpl();
+
+		SecurityPortletContainerWrapper securityPortletContainerWrapper =
+			new SecurityPortletContainerWrapper(portletContainer);
+
+		Assert.assertTrue(
+			securityPortletContainerWrapper.isValidPortletId("aaa"));
+		Assert.assertTrue(
+			securityPortletContainerWrapper.isValidPortletId("AAA"));
+		Assert.assertTrue(
+			securityPortletContainerWrapper.isValidPortletId("123"));
+		Assert.assertTrue(
+			securityPortletContainerWrapper.isValidPortletId("aA1"));
+		Assert.assertTrue(
+			securityPortletContainerWrapper.isValidPortletId("aaa_bbb"));
+		Assert.assertTrue(
+			securityPortletContainerWrapper.isValidPortletId("aaa#bbb"));
+		Assert.assertFalse(
+			securityPortletContainerWrapper.isValidPortletId(
+				"2_INSTANCE_'\"><script>alert(1)</script>"));
+	}
+
+}
\ No newline at end of file

@@ -14,13 +14,11 @@
 
 package com.liferay.portal.service;
 
-import com.liferay.portal.kernel.security.auth.PrincipalException;
 import com.liferay.portal.kernel.test.CaptureHandler;
 import com.liferay.portal.kernel.test.JDKLoggerTestUtil;
 import com.liferay.portal.kernel.test.ReflectionTestUtil;
 import com.liferay.portal.service.impl.PortletLocalServiceImpl;
 
-import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 
 import java.util.List;
@@ -55,20 +53,14 @@ public void testIsValidPortletId() throws Exception {
 				JDKLoggerTestUtil.configureJDKLogger(
 					PortletLocalServiceImpl.class.getName(), Level.WARNING)) {
 
-			String portletId = "2_INSTANCE_'\"><script>alert(1)</script>";
-
 			try {
-				method.invoke(portletLocalServiceImpl, portletId);
+				method.invoke(
+					portletLocalServiceImpl,
+					"2_INSTANCE_'\"><script>alert(1)</script>");
 
 				Assert.fail();
 			}
-			catch (InvocationTargetException ite) {
-				Throwable throwable = ite.getCause();
-
-				Assert.assertSame(
-					PrincipalException.class, throwable.getClass());
-				Assert.assertEquals(
-					"Invalid portlet ID " + portletId, throwable.getMessage());
+			catch (Exception e) {
 			}
 
 			List<LogRecord> logRecords = captureHandler.getLogRecords();

@@ -14,11 +14,13 @@
 
 package com.liferay.portal.service;
 
+import com.liferay.portal.kernel.security.auth.PrincipalException;
 import com.liferay.portal.kernel.test.CaptureHandler;
 import com.liferay.portal.kernel.test.JDKLoggerTestUtil;
 import com.liferay.portal.kernel.test.ReflectionTestUtil;
 import com.liferay.portal.service.impl.PortletLocalServiceImpl;
 
+import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 
 import java.util.List;
@@ -53,14 +55,20 @@ public void testIsValidPortletId() throws Exception {
 				JDKLoggerTestUtil.configureJDKLogger(
 					PortletLocalServiceImpl.class.getName(), Level.WARNING)) {
 
+			String portletId = "2_INSTANCE_'\"><script>alert(1)</script>";
+
 			try {
-				method.invoke(
-					portletLocalServiceImpl,
-					"2_INSTANCE_'\"><script>alert(1)</script>");
+				method.invoke(portletLocalServiceImpl, portletId);
 
 				Assert.fail();
 			}
-			catch (Exception e) {
+			catch (InvocationTargetException ite) {
+				Throwable throwable = ite.getCause();
+
+				Assert.assertSame(
+					PrincipalException.class, throwable.getClass());
+				Assert.assertEquals(
+					"Invalid portlet ID " + portletId, throwable.getMessage());
 			}
 
 			List<LogRecord> logRecords = captureHandler.getLogRecords();

@@ -20,20 +20,16 @@
 import com.liferay.portal.kernel.util.HashMapDictionary;
 import com.liferay.portal.kernel.util.HttpUtil;
 import com.liferay.portal.kernel.util.MapUtil;
-import com.liferay.portal.test.log.CaptureAppender;
-import com.liferay.portal.test.log.Log4JLoggerTestUtil;
 import com.liferay.portal.test.rule.LiferayIntegrationTestRule;
 import com.liferay.portal.util.test.PortletContainerTestUtil;
 import com.liferay.portal.util.test.PortletContainerTestUtil.Response;
 import com.liferay.portlet.PortletURLImpl;
-import com.liferay.portlet.SecurityPortletContainerWrapper;
 
 import java.io.IOException;
 import java.io.PrintWriter;
 
 import java.util.Collections;
 import java.util.Dictionary;
-import java.util.List;
 import java.util.Map;
 
 import javax.portlet.PortletContext;
@@ -49,9 +45,6 @@
 
 import javax.servlet.http.HttpServletRequest;
 
-import org.apache.log4j.Level;
-import org.apache.log4j.spi.LoggingEvent;
-
 import org.junit.Assert;
 import org.junit.ClassRule;
 import org.junit.Rule;
@@ -70,39 +63,6 @@ public class RenderRequestPortletContainerTest
 	public static final AggregateTestRule aggregateTestRule =
 		new LiferayIntegrationTestRule();
 
-	@Test
-	public void testInvalidPortletId() throws Exception {
-		HttpServletRequest httpServletRequest =
-			PortletContainerTestUtil.getHttpServletRequest(group, layout);
-
-		String url =
-			layout.getRegularURL(httpServletRequest) +
-				"?p_p_id='\"><script>alert(1)</script>&p_p_lifecycle=0&" +
-					"p_p_state=exclusive";
-
-		try (CaptureAppender captureAppender =
-				Log4JLoggerTestUtil.configureLog4JLogger(
-					SecurityPortletContainerWrapper.class.getName(),
-					Level.WARN)) {
-
-			Response response = PortletContainerTestUtil.request(url);
-
-			List<LoggingEvent> loggingEvents =
-				captureAppender.getLoggingEvents();
-
-			Assert.assertEquals(
-				loggingEvents.toString(), 1, loggingEvents.size());
-
-			LoggingEvent loggingEvent = loggingEvents.get(0);
-
-			Assert.assertEquals(
-				"Invalid portlet ID '\"><script>alert(1)</script>",
-				loggingEvent.getMessage());
-
-			Assert.assertEquals(200, response.getCode());
-		}
-	}
-
 	@Test
 	public void testIsAccessGrantedByPortletAuthenticationToken()
 		throws Exception {

@@ -20,20 +20,16 @@
 import com.liferay.portal.kernel.util.HashMapDictionary;
 import com.liferay.portal.kernel.util.HttpUtil;
 import com.liferay.portal.kernel.util.MapUtil;
-import com.liferay.portal.test.log.CaptureAppender;
-import com.liferay.portal.test.log.Log4JLoggerTestUtil;
 import com.liferay.portal.test.rule.LiferayIntegrationTestRule;
 import com.liferay.portal.util.test.PortletContainerTestUtil;
 import com.liferay.portal.util.test.PortletContainerTestUtil.Response;
 import com.liferay.portlet.PortletURLImpl;
-import com.liferay.portlet.SecurityPortletContainerWrapper;
 
 import java.io.IOException;
 import java.io.PrintWriter;
 
 import java.util.Collections;
 import java.util.Dictionary;
-import java.util.List;
 import java.util.Map;
 
 import javax.portlet.PortletContext;
@@ -47,9 +43,6 @@
 
 import javax.servlet.http.HttpServletRequest;
 
-import org.apache.log4j.Level;
-import org.apache.log4j.spi.LoggingEvent;
-
 import org.junit.Assert;
 import org.junit.ClassRule;
 import org.junit.Rule;
@@ -68,47 +61,6 @@ public class ResourceRequestPortletContainerTest
 	public static final AggregateTestRule aggregateTestRule =
 		new LiferayIntegrationTestRule();
 
-	@Test
-	public void testInvalidPortletId() throws Exception {
-		HttpServletRequest httpServletRequest =
-			PortletContainerTestUtil.getHttpServletRequest(group, layout);
-
-		String layoutURL = layout.getRegularURL(httpServletRequest);
-
-		String url =
-			layoutURL +
-				"?p_p_id='\"><script>alert(1)</script>&p_p_lifecycle=2&";
-
-		try (CaptureAppender captureAppender =
-				Log4JLoggerTestUtil.configureLog4JLogger(
-					SecurityPortletContainerWrapper.class.getName(),
-					Level.WARN)) {
-
-			Response response = PortletContainerTestUtil.request(url);
-
-			List<LoggingEvent> loggingEvents =
-				captureAppender.getLoggingEvents();
-
-			Assert.assertEquals(
-				loggingEvents.toString(), 2, loggingEvents.size());
-
-			LoggingEvent loggingEvent = loggingEvents.get(0);
-
-			Assert.assertEquals(
-				"Invalid portlet ID '\"><script>alert(1)</script>",
-				loggingEvent.getMessage());
-
-			loggingEvent = loggingEvents.get(1);
-
-			Assert.assertEquals(
-				"Reject serveResource for " + layoutURL +
-					" on '\"><script>alert(1)</script>",
-				loggingEvent.getMessage());
-
-			Assert.assertEquals(400, response.getCode());
-		}
-	}
-
 	@Test
 	public void testIsAccessGrantedByPortletAuthenticationToken()
 		throws Exception {

@@ -0,0 +1,79 @@
+/**
+ * Copyright (c) 2000-present Liferay, Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU Lesser General Public License as published by the Free
+ * Software Foundation; either version 2.1 of the License, or (at your option)
+ * any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
+ * details.
+ */
+
+package com.liferay.portal.service;
+
+import com.liferay.portal.kernel.test.CaptureHandler;
+import com.liferay.portal.kernel.test.JDKLoggerTestUtil;
+import com.liferay.portal.kernel.test.ReflectionTestUtil;
+import com.liferay.portal.service.impl.PortletLocalServiceImpl;
+
+import java.lang.reflect.Method;
+
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.LogRecord;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+/**
+ * @author Matthew Tambara
+ */
+public class ValidPortletIdTest {
+
+	@Test
+	public void testIsValidPortletId() throws Exception {
+		Method method = ReflectionTestUtil.getMethod(
+			PortletLocalServiceImpl.class, "_checkValidPortletId",
+			String.class);
+
+		PortletLocalServiceImpl portletLocalServiceImpl =
+			new PortletLocalServiceImpl();
+
+		method.invoke(portletLocalServiceImpl, "aaa");
+		method.invoke(portletLocalServiceImpl, "AAA");
+		method.invoke(portletLocalServiceImpl, "123");
+		method.invoke(portletLocalServiceImpl, "aA1");
+		method.invoke(portletLocalServiceImpl, "aaa_bbb");
+		method.invoke(portletLocalServiceImpl, "aaa#bbb");
+
+		try (CaptureHandler captureHandler =
+				JDKLoggerTestUtil.configureJDKLogger(
+					PortletLocalServiceImpl.class.getName(), Level.WARNING)) {
+
+			try {
+				method.invoke(
+					portletLocalServiceImpl,
+					"2_INSTANCE_'\"><script>alert(1)</script>");
+
+				Assert.fail();
+			}
+			catch (Exception e) {
+			}
+
+			List<LogRecord> logRecords = captureHandler.getLogRecords();
+
+			Assert.assertEquals(logRecords.toString(), 1, logRecords.size());
+
+			LogRecord logRecord = logRecords.get(0);
+
+			Assert.assertEquals(
+				logRecord.toString(),
+				"Invalid portlet ID 2_INSTANCE_'\"><script>alert(1)</script>",
+				logRecord.getMessage());
+		}
+	}
+
+}
\ No newline at end of file

@@ -1,51 +0,0 @@
-/**
- * Copyright (c) 2000-present Liferay, Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or modify it under
- * the terms of the GNU Lesser General Public License as published by the Free
- * Software Foundation; either version 2.1 of the License, or (at your option)
- * any later version.
- *
- * This library is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
- * details.
- */
-
-package com.liferay.portlet;
-
-import com.liferay.portal.kernel.portlet.PortletContainer;
-
-import org.junit.Assert;
-import org.junit.Test;
-
-/**
- * @author Akos Thurzo
- */
-public class SecurityPortletContainerWrapperTest {
-
-	@Test
-	public void testIsValidPortletId() {
-		PortletContainer portletContainer = new PortletContainerImpl();
-
-		SecurityPortletContainerWrapper securityPortletContainerWrapper =
-			new SecurityPortletContainerWrapper(portletContainer);
-
-		Assert.assertTrue(
-			securityPortletContainerWrapper.isValidPortletId("aaa"));
-		Assert.assertTrue(
-			securityPortletContainerWrapper.isValidPortletId("AAA"));
-		Assert.assertTrue(
-			securityPortletContainerWrapper.isValidPortletId("123"));
-		Assert.assertTrue(
-			securityPortletContainerWrapper.isValidPortletId("aA1"));
-		Assert.assertTrue(
-			securityPortletContainerWrapper.isValidPortletId("aaa_bbb"));
-		Assert.assertTrue(
-			securityPortletContainerWrapper.isValidPortletId("aaa#bbb"));
-		Assert.assertFalse(
-			securityPortletContainerWrapper.isValidPortletId(
-				"2_INSTANCE_'\"><script>alert(1)</script>"));
-	}
-
-}
\ No newline at end of file

@@ -58,6 +58,7 @@
 import com.liferay.portal.kernel.scheduler.TimeUnit;
 import com.liferay.portal.kernel.scheduler.Trigger;
 import com.liferay.portal.kernel.scheduler.TriggerFactoryUtil;
+import com.liferay.portal.kernel.security.auth.PrincipalException;
 import com.liferay.portal.kernel.security.permission.ActionKeys;
 import com.liferay.portal.kernel.security.permission.ResourceActionsUtil;
 import com.liferay.portal.kernel.service.permission.PortletPermissionUtil;
@@ -282,6 +283,8 @@ public void deletePortlets(long companyId, String[] portletIds, long plid)
 	@Override
 	@Skip
 	public void deployPortlet(Portlet portlet) throws Exception {
+		_checkValidPortletId(portlet.getPortletId());
+
 		PortletApp portletApp = portlet.getPortletApp();
 
 		_portletApps.put(portletApp.getServletContextName(), portletApp);
@@ -322,6 +325,8 @@ public Portlet deployRemotePortlet(
 			Portlet portlet, String[] categoryNames, boolean eagerDestroy)
 		throws PortalException {
 
+		_checkValidPortletId(portlet.getPortletId());
+
 		_portletsMap.put(portlet.getPortletId(), portlet);
 
 		if (eagerDestroy) {
@@ -2619,6 +2624,36 @@ protected Portlet updatePortlet(
 		return updatePortlet(companyId, portletId, roles, active);
 	}
 
+	private void _checkValidPortletId(String portletId)
+		throws PrincipalException {
+
+		for (int i = 0; i < portletId.length(); i++) {
+			char c = portletId.charAt(i);
+
+			if ((c >= CharPool.LOWER_CASE_A) && (c <= CharPool.LOWER_CASE_Z)) {
+				continue;
+			}
+
+			if ((c >= CharPool.UPPER_CASE_A) && (c <= CharPool.UPPER_CASE_Z)) {
+				continue;
+			}
+
+			if ((c >= CharPool.NUMBER_0) && (c <= CharPool.NUMBER_9)) {
+				continue;
+			}
+
+			if ((c == CharPool.POUND) || (c == CharPool.UNDERLINE)) {
+				continue;
+			}
+
+			if (_log.isWarnEnabled()) {
+				_log.warn("Invalid portlet ID " + portletId);
+			}
+
+			throw new PrincipalException("Invalid portlet ID " + portletId);
+		}
+	}
+
 	private static final Log _log = LogFactoryUtil.getLog(
 		PortletLocalServiceImpl.class);
 

@@ -175,15 +175,6 @@ protected void check(HttpServletRequest request, Portlet portlet)
 			return;
 		}
 
-		if (!isValidPortletId(portlet.getPortletId())) {
-			if (_log.isWarnEnabled()) {
-				_log.warn("Invalid portlet ID " + portlet.getPortletId());
-			}
-
-			throw new PrincipalException(
-				"Invalid portlet ID " + portlet.getPortletId());
-		}
-
 		if (portlet.isUndeployedPortlet()) {
 			return;
 		}
@@ -306,6 +297,10 @@ protected HttpServletRequest getOwnerLayoutRequestWrapper(
 		return tempAttributesServletRequest;
 	}
 
+	/**
+	 * @deprecated As of 7.0.0, with no direct replacement
+	 */
+	@Deprecated
 	protected boolean isValidPortletId(String portletId) {
 		for (int i = 0; i < portletId.length(); i++) {
 			char c = portletId.charAt(i);

@@ -61,7 +61,6 @@
 import com.liferay.portal.kernel.scheduler.TimeUnit;
 import com.liferay.portal.kernel.scheduler.Trigger;
 import com.liferay.portal.kernel.scheduler.TriggerFactoryUtil;
-import com.liferay.portal.kernel.security.auth.PrincipalException;
 import com.liferay.portal.kernel.security.permission.ActionKeys;
 import com.liferay.portal.kernel.security.permission.ResourceActionsUtil;
 import com.liferay.portal.kernel.service.permission.PortletPermissionUtil;
@@ -288,8 +287,6 @@ public void deletePortlets(long companyId, String[] portletIds, long plid)
 	@Override
 	@Skip
 	public void deployPortlet(Portlet portlet) throws Exception {
-		_checkValidPortletId(portlet.getPortletId());
-
 		PortletApp portletApp = portlet.getPortletApp();
 
 		_portletApps.put(portletApp.getServletContextName(), portletApp);
@@ -330,8 +327,6 @@ public Portlet deployRemotePortlet(
 			Portlet portlet, String[] categoryNames, boolean eagerDestroy)
 		throws PortalException {
 
-		_checkValidPortletId(portlet.getPortletId());
-
 		ResourceActionsUtil.check(portlet);
 
 		_portletsMap.put(portlet.getPortletId(), portlet);
@@ -2733,36 +2728,6 @@ protected Portlet updatePortlet(
 		return updatePortlet(companyId, portletId, roles, active);
 	}
 
-	private void _checkValidPortletId(String portletId)
-		throws PrincipalException {
-
-		for (int i = 0; i < portletId.length(); i++) {
-			char c = portletId.charAt(i);
-
-			if ((c >= CharPool.LOWER_CASE_A) && (c <= CharPool.LOWER_CASE_Z)) {
-				continue;
-			}
-
-			if ((c >= CharPool.UPPER_CASE_A) && (c <= CharPool.UPPER_CASE_Z)) {
-				continue;
-			}
-
-			if ((c >= CharPool.NUMBER_0) && (c <= CharPool.NUMBER_9)) {
-				continue;
-			}
-
-			if ((c == CharPool.POUND) || (c == CharPool.UNDERLINE)) {
-				continue;
-			}
-
-			if (_log.isWarnEnabled()) {
-				_log.warn("Invalid portlet ID " + portletId);
-			}
-
-			throw new PrincipalException("Invalid portlet ID " + portletId);
-		}
-	}
-
 	private boolean _isCustomPortletMode(String portletModeName) {
 		return PortalUtil.isCustomPortletMode(new PortletMode(portletModeName));
 	}

@@ -190,6 +190,15 @@ protected void check(HttpServletRequest request, Portlet portlet)
 			return;
 		}
 
+		if (!isValidPortletId(portlet.getPortletId())) {
+			if (_log.isWarnEnabled()) {
+				_log.warn("Invalid portlet ID " + portlet.getPortletId());
+			}
+
+			throw new PrincipalException(
+				"Invalid portlet ID " + portlet.getPortletId());
+		}
+
 		if (portlet.isUndeployedPortlet()) {
 			return;
 		}
@@ -312,10 +321,6 @@ protected HttpServletRequest getOwnerLayoutRequestWrapper(
 		return tempAttributesServletRequest;
 	}
 
-	/**
-	 * @deprecated As of 7.0.0, with no direct replacement
-	 */
-	@Deprecated
 	protected boolean isValidPortletId(String portletId) {
 		for (int i = 0; i < portletId.length(); i++) {
 			char c = portletId.charAt(i);