This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 35f1a662a4 Fixed: Check the owner of the shopping list in
checkShoppingListSecurity
35f1a662a4 is described below
commit 35f1a662a461a7f0075b6df520df52022ea5a40a
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Oct 20 13:52:46 2026 +0530
Fixed: Check the owner of the shopping list in checkShoppingListSecurity
checkShoppingListSecurity only compared the partyId passed to the service
with the logged-in user, and did not look at who owns the shopping list being
updated or removed. It now loads the list when a shoppingListId is passed and
requires the logged-in user to be its owner or to have the PARTYMGR permission,
as checkShoppingListItemSecurity already does for list items.
---
applications/order/servicedef/services_shoppinglist.xml | 1 +
.../ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy | 7 +++++++
2 files changed, 8 insertions(+)
diff --git a/applications/order/servicedef/services_shoppinglist.xml
b/applications/order/servicedef/services_shoppinglist.xml
index 8e46990395..41eaac2f49 100644
--- a/applications/order/servicedef/services_shoppinglist.xml
+++ b/applications/order/servicedef/services_shoppinglist.xml
@@ -56,6 +56,7 @@ under the License.
<description>Checks security on a ShoppingList</description>
<implements service="permissionInterface"/>
<attribute name="partyId" type="String" mode="IN" optional="true"/>
+ <attribute name="shoppingListId" type="String" mode="IN"
optional="true"/>
</service>
<service name="calculateShoppingListDeepTotalPrice" engine="groovy"
auth="true"
location="component://order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy"
invoke="calculateShoppingListDeepTotalPrice">
diff --git
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
index f94fbc34a3..58c61a3976 100644
---
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
+++
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
@@ -213,6 +213,13 @@ Map calculateShoppingListDeepTotalPrice() {
* Checks security on a ShoppingList
*/
Map checkShoppingListSecurity() {
+ // for an existing list, check against its stored owner, not the partyId
sent with the request
+ if (parameters.shoppingListId) {
+ GenericValue shoppingList = from('ShoppingList').where(shoppingListId:
parameters.shoppingListId).queryOne()
+ require(!shoppingList?.partyId || userLogin?.partyId ==
shoppingList.partyId
+ || security.hasEntityPermission('PARTYMGR',
"_${parameters.permissionAction}", parameters.userLogin),
+ 'OrderErrorUiLabels', 'OrderSecurityErrorToRunForAnotherParty')
+ }
require(!userLogin || (userLogin.userLoginId == 'anonymous') ||
!parameters.partyId || (userLogin.partyId == parameters.partyId)
|| security.hasEntityPermission('PARTYMGR',
"_${parameters.permissionAction}", parameters.userLogin),
