This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 4b66396fa2 Fixed: Payment method create services accept a
caller-supplied paymentMethodId without verifying it belongs to the authorized
party (OFBIZ-13671)
4b66396fa2 is described below
commit 4b66396fa25e287c476a1d3685b8ad393dc70e48
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Oct 12 16:52:49 2026 +0530
Fixed: Payment method create services accept a caller-supplied
paymentMethodId without verifying it belongs to the authorized party
(OFBIZ-13671)
- createCreditCard, createGiftCard, createEftAccount, and
createCheckAccount now reject a supplied paymentMethodId that already belongs
to a different party.
- Added the shared checkPaymentMethodOwnership helper and the
AccountingPaymentMethodIdBelongsToAnotherParty error label.
---
.../accounting/config/AccountingUiLabels.xml | 3 ++
.../accounting/payment/PaymentMethodServices.java | 39 ++++++++++++++++++++++
2 files changed, 42 insertions(+)
diff --git a/applications/accounting/config/AccountingUiLabels.xml
b/applications/accounting/config/AccountingUiLabels.xml
index 058c60e78a..d62cf179c3 100644
--- a/applications/accounting/config/AccountingUiLabels.xml
+++ b/applications/accounting/config/AccountingUiLabels.xml
@@ -11980,6 +11980,9 @@
<value xml:lang="zh">会计支付方法标识........</value>
<value xml:lang="zh-TW">會計支付方法識別........</value>
</property>
+ <property key="AccountingPaymentMethodIdBelongsToAnotherParty">
+ <value xml:lang="en">Payment Method ID is already in use.</value>
+ </property>
<property key="AccountingPaymentMethodIdMissing">
<value xml:lang="ar">دليل طريقة الدفع مفقود</value>
<value xml:lang="de">Zahlungsmethode fehlt</value>
diff --git
a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java
b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java
index c2b5171d36..97a4144d05 100644
---
a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java
+++
b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java
@@ -52,6 +52,25 @@ public class PaymentMethodServices {
private static final String RESOURCE = "AccountingUiLabels";
private static final String RES_ERROR = "AccountingUiLabels";
+ /**
+ * A create service may be called with a caller-supplied paymentMethodId
instead of letting one be
+ * auto-sequenced. If that id already belongs to a PaymentMethod owned by
a different party, creating under
+ * that id would overwrite the existing owner's record, so this is
rejected rather than allowed through.
+ * @return an error Map if paymentMethodId already belongs to a different
party, otherwise null
+ */
+ private static Map<String, Object> checkPaymentMethodOwnership(Delegator
delegator, String paymentMethodId, String partyId, Locale locale) {
+ try {
+ GenericValue existingPm =
EntityQuery.use(delegator).from("PaymentMethod").where("paymentMethodId",
paymentMethodId).queryOne();
+ if (existingPm != null &&
!partyId.equals(existingPm.getString("partyId"))) {
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"AccountingPaymentMethodIdBelongsToAnotherParty", locale));
+ }
+ } catch (GenericEntityException e) {
+ Debug.logWarning(e.getMessage(), MODULE);
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"AccountingPaymentMethodIdBelongsToAnotherParty", locale));
+ }
+ return null;
+ }
+
/**
* Deletes a PaymentMethod entity according to the parameters passed in
the context
* <b>security check</b>: userLogin partyId must equal paymentMethod
partyId, or must have PAY_INFO_DELETE permission
@@ -184,6 +203,11 @@ public class PaymentMethodServices {
return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"AccountingCreditCardCreateIdGenerationFailure",
locale));
}
+ } else {
+ Map<String, Object> ownershipError =
checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+ if (ownershipError != null) {
+ return ownershipError;
+ }
}
newPm.set("partyId", partyId);
@@ -522,6 +546,11 @@ public class PaymentMethodServices {
return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
"AccountingGiftCardCannotBeCreated", locale));
}
+ } else {
+ Map<String, Object> ownershipError =
checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+ if (ownershipError != null) {
+ return ownershipError;
+ }
}
newPm.set("partyId", partyId);
@@ -718,6 +747,11 @@ public class PaymentMethodServices {
return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
"AccountingEftAccountCannotBeCreated", locale));
}
+ } else {
+ Map<String, Object> ownershipError =
checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+ if (ownershipError != null) {
+ return ownershipError;
+ }
}
newPm.set("partyId", partyId);
@@ -956,6 +990,11 @@ public class PaymentMethodServices {
} catch (IllegalArgumentException e) {
return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
"AccountingCheckNotAdded", locale));
}
+ } else {
+ Map<String, Object> ownershipError =
checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+ if (ownershipError != null) {
+ return ownershipError;
+ }
}
newPm.set("partyId", partyId);
