This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 0100f2db3d Fixed: Add missing permission checks to order ship-group
and return-adjustment services (OFBIZ-13710)
0100f2db3d is described below
commit 0100f2db3d1728cbdc7f9a341b0caa6bc30caa10
Author: Mridul Pathak <[email protected]>
AuthorDate: Thu Oct 22 18:04:36 2026 +0530
Fixed: Add missing permission checks to order ship-group and
return-adjustment services (OFBIZ-13710)
- createReturnAdjustment (reached via createReturnItemOrAdjustment when
orderItemSeqId is absent) now requires the same returnPermissionCheck already
enforced on sibling return services.
- deleteOrderItemShipGroup, addOrderItemShipGroupAssoc,
updateOrderItemShipGroupAssoc and deleteOrderItemShipGroupAssoc now require a
new orderItemShipGroupPermissionCheck, matching the existing
orderAdjustmentPermissionCheck convention used by sibling order-mutation
services.
---
applications/order/minilang/order/OrderSimpleMethods.xml | 5 +++++
applications/order/servicedef/services.xml | 10 ++++++++++
applications/order/servicedef/services_return.xml | 1 +
3 files changed, 16 insertions(+)
diff --git a/applications/order/minilang/order/OrderSimpleMethods.xml
b/applications/order/minilang/order/OrderSimpleMethods.xml
index a12888ae09..0b582027ad 100644
--- a/applications/order/minilang/order/OrderSimpleMethods.xml
+++ b/applications/order/minilang/order/OrderSimpleMethods.xml
@@ -44,6 +44,11 @@ under the License.
</else>
</if-compare>
</simple-method>
+ <simple-method method-name="orderItemShipGroupPermissionCheck"
short-description="Permission service for the creation, editing and removal of
order item ship groups">
+ <set field="primaryPermission" value="ORDERMGR"/>
+ <set field="altPermission" value="ORDERMGR_ROLE"/>
+ <call-simple-method method-name="genericBasePermissionCheck"
xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
+ </simple-method>
<simple-method method-name="updateOrderStatusFromReceipt"
short-description="Update Order Status From ShipmentReceipt">
<check-permission permission="ORDERMGR"
action="_UPDATE"><fail-property resource="OrderErrorUiLabels"
property="OrderSecurityErrorToRunUpdateOrderStatusFromReceipt"/></check-permission>
<check-errors/>
diff --git a/applications/order/servicedef/services.xml
b/applications/order/servicedef/services.xml
index e46150fc1d..5096204b31 100644
--- a/applications/order/servicedef/services.xml
+++ b/applications/order/servicedef/services.xml
@@ -239,6 +239,12 @@ under the License.
<implements service="permissionInterface"/>
</service>
+ <service name="orderItemShipGroupPermissionCheck" engine="simple"
+ location="component://order/minilang/order/OrderSimpleMethods.xml"
invoke="orderItemShipGroupPermissionCheck">
+ <description>Permission service for the creation, editing and removal
of order item ship groups</description>
+ <implements service="permissionInterface"/>
+ </service>
+
<service name="createOrderAdjustment"
default-entity-name="OrderAdjustment" engine="entity-auto" invoke="create">
<description>Creates a new order adjustment record</description>
<permission-service service-name="orderAdjustmentPermissionCheck"
main-action="CREATE"/>
@@ -1475,6 +1481,7 @@ under the License.
location="org.apache.ofbiz.order.order.OrderServices"
invoke="deleteOrderItemShipGroup">
<description>delete Order Item Ship Group </description>
+ <permission-service service-name="orderItemShipGroupPermissionCheck"
main-action="DELETE"/>
<auto-attributes include="pk" mode="IN" optional="false"/>
</service>
@@ -1482,6 +1489,7 @@ under the License.
location="org.apache.ofbiz.order.order.OrderServices"
invoke="addOrderItemShipGroupAssoc">
<description>add Order Item Ship Group Assoc and if order item ship
group not exit, create it before</description>
+ <permission-service service-name="orderItemShipGroupPermissionCheck"
main-action="CREATE"/>
<implements service="addOrderItemShipGroup" optional="true"/>
<auto-attributes include="pk" mode="IN" optional="false"/>
<auto-attributes include="nonpk" mode="IN" optional="true"/>
@@ -1490,6 +1498,7 @@ under the License.
location="org.apache.ofbiz.order.order.OrderServices"
invoke="updateOrderItemShipGroupAssoc">
<description>update OrderItem from OISG, totalQuantity is used only if
controller is a multi services </description>
+ <permission-service service-name="orderItemShipGroupPermissionCheck"
main-action="UPDATE"/>
<auto-attributes include="all" mode="IN" optional="true"/>
<attribute name="totalQuantity" type="BigDecimal" mode="INOUT"
optional="true"/>
<attribute name="rowCount" type="Integer" mode="IN" optional="true"/>
@@ -1497,6 +1506,7 @@ under the License.
</service>
<service name="deleteOrderItemShipGroupAssoc" engine="entity-auto"
auth="true" default-entity-name="OrderItemShipGroupAssoc" invoke="delete">
<description>delete Order Item Ship Group Assoc</description>
+ <permission-service service-name="orderItemShipGroupPermissionCheck"
main-action="DELETE"/>
<auto-attributes include="pk" mode="IN" optional="false"/>
</service>
diff --git a/applications/order/servicedef/services_return.xml
b/applications/order/servicedef/services_return.xml
index 2194a581ca..eb4bf95c32 100644
--- a/applications/order/servicedef/services_return.xml
+++ b/applications/order/servicedef/services_return.xml
@@ -125,6 +125,7 @@ under the License.
<service name="createReturnAdjustment" engine="java"
location="org.apache.ofbiz.order.order.OrderReturnServices"
invoke="createReturnAdjustment">
<description>Simple create service</description>
+ <permission-service service-name="returnPermissionCheck"
main-action="CREATE"/>
<implements service="returnAdjustmentInterface"/>
<override name="returnAdjustmentId" mode="OUT" optional="false"/>
</service>
