(ofbiz-framework) branch trunk updated: Fixed: createReturnItem() does not verify OrderItem ownership before attaching it to a ReturnHeader

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 98e498f9a2 Fixed: createReturnItem() does not verify OrderItem 
ownership before attaching it to a ReturnHeader
98e498f9a2 is described below

commit 98e498f9a24dbf4e961761f279f0cdc4c210b40c
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Tue Oct 13 11:43:50 2026 +0530

    Fixed: createReturnItem() does not verify OrderItem ownership before 
attaching it to a ReturnHeader
    
    createReturnItem() authorizes the request against the supplied ReturnHeader 
(ORDERMGR_CREATE or ReturnHeader.fromPartyId == userLogin.partyId), but then 
resolves the OrderItem from caller-supplied orderId/orderItemSeqId without 
checking that it belongs to an order associated with ReturnHeader.fromPartyId. 
This let a non-privileged caller attach an OrderItem from an unrelated order to 
a ReturnHeader they control. For callers without ORDERMGR_CREATE, this now 
requires an OrderRole linki [...]
---
 .../apache/ofbiz/order/order/OrderReturnServicesScript.groovy  | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
index 52eb016384..9cc22e1caa 100644
--- 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
+++ 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
@@ -218,6 +218,16 @@ Map createReturnItem() {
             logInfo('Return item is an Order Item - ' + 
orderItem.orderItemSeqId)
         }
     }
+    if (orderItem && !security.hasEntityPermission('ORDERMGR', '_CREATE', 
parameters.userLogin)) {
+        // the ReturnHeader was only authorized via fromPartyId == 
userLogin.partyId above;
+        // make sure that party actually has a role on the order the selected 
item belongs to
+        GenericValue orderRole = from('OrderRole')
+                .where(orderId: orderItem.orderId, partyId: 
returnHeader.fromPartyId)
+                .queryFirst()
+        if (!orderRole) {
+            return informError('OrderSecurityErrorToRunCreateReturnItem')
+        }
+    }
     /*
      * get the returnableQuantity and returnablePrice:
      * for orderItems, it's found by getReturnableQuantity;