(ofbiz-framework) branch release24.09 updated: Fixed: Anonymous ecommerce checkout accepts an arbitrary partyId and lets it be used to overwrite another party's name and attach caller-supplied contact and payment data to that party (OFBIZ-13669)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 483b6522f7 Fixed: Anonymous ecommerce checkout accepts an arbitrary 
partyId and lets it be used to overwrite another party's name and attach 
caller-supplied contact and payment data to that party (OFBIZ-13669)
483b6522f7 is described below

commit 483b6522f71d1fb2790a50d91f32035466cbdbfc
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Fri Oct 9 19:34:34 2026 +0530

    Fixed: Anonymous ecommerce checkout accepts an arbitrary partyId and lets 
it be used to overwrite another party's name and attach caller-supplied contact 
and payment data to that party (OFBIZ-13669)
    
    - setAnonUserLogin and createUpdateBillingAddressAndPaymentMethod now 
reject a request-supplied partyId that does not match the party already 
associated with the caller's own shopping cart, instead of trusting it 
unconditionally.
    - Added the OrderPartyIdDoesNotMatchCartParty error label for the rejection 
message.
---
 applications/order/config/OrderErrorUiLabels.xml         |  3 +++
 .../org/apache/ofbiz/order/order/CheckoutServices.groovy | 16 ++++++++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/applications/order/config/OrderErrorUiLabels.xml 
b/applications/order/config/OrderErrorUiLabels.xml
index 2501aac92e..06b2ac8756 100644
--- a/applications/order/config/OrderErrorUiLabels.xml
+++ b/applications/order/config/OrderErrorUiLabels.xml
@@ -2480,6 +2480,9 @@
         <value xml:lang="zh">没有定义会员标识和/或角色类型标识。 </value>
         <value xml:lang="zh-TW">沒有定義成員ID和/或角色類型ID。 </value>
     </property>
+    <property key="OrderPartyIdDoesNotMatchCartParty">
+        <value xml:lang="en">The partyId supplied does not match the party 
already associated with this order.</value>
+    </property>
     <property key="OrderPleaseContactCustomerServicePaymentReturnCodeUnknown">
         <value xml:lang="ar">يرجى الإتصال بخدمة العملاء: رمز استرجاع الدفعة 
غير معروف.</value>
         <value xml:lang="de">Bitte kontaktieren Sie den Kundenservice; 
unbekannter Rückgabewert beim Zahlungsvorgang. </value>
diff --git 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/order/CheckoutServices.groovy
 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/order/CheckoutServices.groovy
index a0780af969..3f556d53b1 100644
--- 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/order/CheckoutServices.groovy
+++ 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/order/CheckoutServices.groovy
@@ -124,6 +124,11 @@ Map createUpdateBillingAddressAndPaymentMethod() {
     }
 
     ShoppingCart shoppingCart = parameters.shoppingCart
+    // The caller may echo back the party already associated with this cart, 
but must never be able to introduce
+    // a different, unrelated partyId: doing so would let an anonymous caller 
attach billing/payment data to
+    // someone else's party.
+    require(!(parameters.partyId && parameters.partyId != 
shoppingCart?.getPartyId()),
+            'OrderErrorUiLabels', 'OrderPartyIdDoesNotMatchCartParty')
     GenericValue userLogin = shoppingCart.getUserLogin()
     String partyId = parameters.partyId
     // If registered user is coming then take partyId from userLogin
@@ -192,11 +197,18 @@ Map createUpdateBillingAddressAndPaymentMethod() {
  */
 Map setAnonUserLogin() {
     ShoppingCart shoppingCart = parameters.shoppingCart
+    // The caller may echo back the party already associated with this cart 
(e.g. a hidden form field on a
+    // later checkout step), but must never be able to introduce a different, 
unrelated partyId: doing so would let
+    // an anonymous caller attach their own checkout data to someone else's 
party.
+    String cartPartyId = shoppingCart.getPartyId()
+    if (parameters.partyId && parameters.partyId != cartPartyId) {
+        return error('OrderErrorUiLabels', 'OrderPartyIdDoesNotMatchCartParty')
+    }
     GenericValue userLogin = shoppingCart.getUserLogin()
     if (userLogin) {
         // If an anonymous user is coming back, update the party id in the 
userLogin object
-        if (userLogin.userLoginId == 'anonymous' && parameters.partyId) {
-            userLogin.partyId = parameters.partyId
+        if (userLogin.userLoginId == 'anonymous' && cartPartyId) {
+            userLogin.partyId = cartPartyId
         }
     } else {
         userLogin = from('UserLogin').where(userLoginId: 
'anonymous').queryOne()