docs: protected void enforceConfigPermission(
              final HttpServletRequest httpServletRequest, final IPortletWindow portletWindow) {
  
          Validate.notNull(
                  httpServletRequest, "Servlet request must not be null to determine remote user.");
          Validate.notNull(portletWindow, "Portlet window must not be null to determine its mode.");
  
          final PortletMode portletMode = portletWindow.getPortletMode();
          if (portletMode != null) {
              if (IPortletRenderer.CONFIG.equals(portletMode)) {
                  final IPerson person = this.personManager.getPerson(httpServletRequest);
  
                  final EntityIdentifier ei = person.getEntityIdentifier();
                  final AuthorizationServiceFacade authorizationServiceFacade =
                          AuthorizationServiceFacade.instance();
                  final IAuthorizationPrincipal ap =
                          authorizationServiceFacade.newPrincipal(ei.getKey(), ei.getType());
  
                  final IPortletEntity portletEntity = portletWindow.getPortletEntity();
                  final IPortletDefinition portletDefinition = portletEntity.getPortletDefinition();
  
                  if (!ap.canConfigure(portletDefinition.getPortletDefinitionId().getStringId())) {
  
                      logger.error(
                              "User {} attempted to use portlet {} in {} but lacks permission to use that mode.  "
                                      + "THIS MAY BE AN ATTEMPT TO EXPLOIT A HISTORICAL SECURITY FLAW.  "
                                      + "You should probably figure out who this user is and why they are trying to access "
                                      + "unauthorized portlet modes.",
                              person.getUserName(),
                              portletDefinition.getFName(),
                              portletMode);
  
                      throw new AuthorizationException(
                              person.getUserName()
                                      + " does not have permission to render '"
                                      + portletDefinition.getFName()
                                      + "' in "
                                      + portletMode
                                      + " PortletMode.");
                  }
              }
          }
      }