This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 3ca5d2b65d Fixed: Add a missing permission check to the party-linking
service (OFBIZ-13711)
3ca5d2b65d is described below
commit 3ca5d2b65d79544ac58def8557d185f9900b39c5
Author: Mridul Pathak <[email protected]>
AuthorDate: Thu Oct 22 18:29:03 2026 +0530
Fixed: Add a missing permission check to the party-linking service
(OFBIZ-13711)
linkPartyRecord now requires the same party-update permission already
enforced on sibling party-mutation services in the same file (e.g.
updateAffiliate).
---
applications/party/servicedef/services.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/applications/party/servicedef/services.xml
b/applications/party/servicedef/services.xml
index 0417f15f8d..fceeab9d8c 100644
--- a/applications/party/servicedef/services.xml
+++ b/applications/party/servicedef/services.xml
@@ -283,6 +283,7 @@ under the License.
<service name="linkPartyRecord" engine="java" auth="true"
use-transaction="false"
location="org.apache.ofbiz.party.party.PartyServices"
invoke="linkParty">
<description>Merges customer accounts and disabled the
duplicate</description>
+ <permission-service service-name="partyBasePermissionCheck"
main-action="UPDATE"/>
<attribute name="partyId" type="String" mode="INOUT" optional="false"/>
<attribute name="partyIdTo" type="String" mode="IN" optional="false"/>
</service>
