(ofbiz-framework) branch release24.09 updated: Fixed: Check that the dataResourceId belongs to the contentId in SimpleContentViewHandler

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new d8c71e71fd Fixed: Check that the dataResourceId belongs to the 
contentId in SimpleContentViewHandler
d8c71e71fd is described below

commit d8c71e71fdf3fa330ca486e91a84bb22cde3cb7a
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Tue Oct 20 14:36:42 2026 +0530

    Fixed: Check that the dataResourceId belongs to the contentId in 
SimpleContentViewHandler
    
    When both contentId and dataResourceId are passed, SimpleContentViewHandler 
now verifies that the DataResource is the one referenced by the Content before 
streaming it, since the view permission check is done on the contentId.
---
 .../org/apache/ofbiz/content/view/SimpleContentViewHandler.java    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git 
a/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
 
b/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
index ae177cd102..2ee922a0a9 100644
--- 
a/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
+++ 
b/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
@@ -103,6 +103,13 @@ public class SimpleContentViewHandler extends 
AbstractViewHandler {
                 Debug.logVerbose("dataResourceId:" + dataResourceId, MODULE);
             }
             Delegator delegator = (Delegator) 
request.getAttribute("delegator");
+            if (UtilValidate.isNotEmpty(dataResourceId) && 
UtilValidate.isNotEmpty(contentId)) {
+                // the permission check below is done on the contentId, so the 
given dataResourceId must belong to that content
+                GenericValue content = 
EntityQuery.use(delegator).from("Content").where("contentId", 
contentId).cache().queryOne();
+                if (content == null || 
!dataResourceId.equals(content.getString("dataResourceId"))) {
+                    throw new ViewHandlerException("DataResource [" + 
dataResourceId + "] is not associated with Content [" + contentId + "]");
+                }
+            }
             if (UtilValidate.isEmpty(dataResourceId)) {
                 if (UtilValidate.isEmpty(contentRevisionSeqId)) {
                     if (UtilValidate.isEmpty(mapKey) && 
UtilValidate.isEmpty(contentAssocTypeId)) {