(ofbiz-framework) branch release24.09 updated: Fixed: Shopping list permission services check the wrong permission action (OFBIZ-13702)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new a12cafc095 Fixed: Shopping list permission services check the wrong 
permission action (OFBIZ-13702)
a12cafc095 is described below

commit a12cafc095b78fbba7978d26c6ad33dc0ce6cfae
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Wed Oct 21 17:20:29 2026 +0530

    Fixed: Shopping list permission services check the wrong permission action 
(OFBIZ-13702)
    
    - checkShoppingListSecurity and checkShoppingListItemSecurity built the 
PARTYMGR permission from a permissionAction parameter that permissionInterface 
does not define, so only PARTYMGR_ADMIN passed. They now use mainAction, and 
fill the error message from resourceDescription and mainAction instead of 
leaving the placeholders empty.
    - calculateShoppingListDeepTotalPrice called checkShoppingListItemSecurity 
without an action. It now checks with the VIEW action, as the original minilang 
did.
---
 .../shoppinglist/ShoppingListServicesScript.groovy    | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
index e69ca50bc0..8206e33219 100644
--- 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
+++ 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
@@ -176,7 +176,8 @@ Map addDistinctShoppingListItem() {
  */
 Map calculateShoppingListDeepTotalPrice() {
     Map result = success()
-    Map serviceResult = run service: 'checkShoppingListItemSecurity', with: 
parameters
+    Map serviceResult = run service: 'checkShoppingListItemSecurity', with: 
[*: parameters,
+            mainAction: 'VIEW', resourceDescription: 
'calculateShoppingListDeepTotalPrice']
     if (!ServiceUtil.isSuccess(serviceResult)) {
         return error(serviceResult.errorMessage)
     }
@@ -237,14 +238,16 @@ Map checkShoppingListSecurity() {
     if (parameters.shoppingListId) {
         GenericValue shoppingList = from('ShoppingList').where(shoppingListId: 
parameters.shoppingListId).queryOne()
         if (shoppingList?.partyId && userLogin?.partyId != shoppingList.partyId
-                && !security.hasEntityPermission('PARTYMGR', 
"_${parameters.permissionAction}", parameters.userLogin)) {
-            return error(UtilProperties.getMessage('OrderErrorUiLabels', 
'OrderSecurityErrorToRunForAnotherParty', parameters.locale))
+                && !security.hasEntityPermission('PARTYMGR', 
"_${parameters.mainAction}", parameters.userLogin)) {
+            return error(UtilProperties.getMessage('OrderErrorUiLabels', 
'OrderSecurityErrorToRunForAnotherParty',
+                    [parentMethodName: parameters.resourceDescription, 
permissionAction: parameters.mainAction], parameters.locale))
         }
     }
     if (userLogin && (userLogin.userLoginId != 'anonymous') &&
             parameters.partyId && (userLogin.partyId != parameters.partyId)
-            && !security.hasEntityPermission('PARTYMGR', 
"_${parameters.permissionAction}", parameters.userLogin)) {
-        return error(UtilProperties.getMessage('OrderErrorUiLabels', 
'OrderSecurityErrorToRunForAnotherParty', parameters.locale))
+            && !security.hasEntityPermission('PARTYMGR', 
"_${parameters.mainAction}", parameters.userLogin)) {
+        return error(UtilProperties.getMessage('OrderErrorUiLabels', 
'OrderSecurityErrorToRunForAnotherParty',
+                [parentMethodName: parameters.resourceDescription, 
permissionAction: parameters.mainAction], parameters.locale))
     }
 
     Map result = success()
@@ -258,11 +261,11 @@ Map checkShoppingListSecurity() {
 Map checkShoppingListItemSecurity() {
     GenericValue shoppingList = 
from('ShoppingList').where(parameters).queryOne()
     if (shoppingList?.partyId && userLogin.partyId != shoppingList.partyId &&
-            !security.hasEntityPermission('PARTYMGR', 
"_${parameters.permissionAction}", parameters.userLogin)) {
+            !security.hasEntityPermission('PARTYMGR', 
"_${parameters.mainAction}", parameters.userLogin)) {
         return error(UtilProperties.getMessage('OrderErrorUiLabels',
                 'OrderSecurityErrorToRunForAnotherParty',
-                [parentMethodName: parameters.parentMethodName,
-                 permissionAction: parameters.permissionAction],
+                [parentMethodName: parameters.resourceDescription,
+                 permissionAction: parameters.mainAction],
                 parameters.locale))
     }