Authorization Bypass

portal-impl is vulnerable to authorization bypass. The property portlet.resource.id.banned.paths.regexp can be bypassed with doubled encoded URLs...