This is an automated email from the ASF dual-hosted git repository. mridulpathak pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 4535e37a15140dc459c336d6ee3d4b38f1ed0fd9 Author: Mridul Pathak <[email protected]> AuthorDate: Thu Oct 22 22:17:43 2026 +0530 Fixed: Add missing permission checks to product costing, catalog and shipment-method services (OFBIZ-13715) - CostComponent/ProductCostComponentCalc (create/update/delete), createProductPaymentMethodType, createProductGroupOrder, CarrierShipmentMethod (create/update), updateShipmentMethodType, removeShipmentEstimate and ShipmentTimeEstimate (update/expire) now require the existing productGenericPermission, matching the convention already used 38x elsewhere in services.xml. - ProductStoreGroup (create/update) and createProductStoreGroupMember now require the existing productStoreGenericPermission, matching sibling store services. - ProductPriceAction (create/update/delete) now require the existing productPriceGenericPermission, matching sibling createProductPriceRule/updateProductPriceRule. - balanceInventoryItems and setOrderReservationPriority now require a new orderInventoryPermissionCheck, since no sibling in this order-management inventory-reservation cluster had any permission check to reuse. --- applications/product/servicedef/services.xml | 2 ++ applications/product/servicedef/services_cost.xml | 6 ++++++ applications/product/servicedef/services_facility.xml | 7 +++++++ applications/product/servicedef/services_pricepromo.xml | 3 +++ applications/product/servicedef/services_shipment.xml | 6 ++++++ applications/product/servicedef/services_store.xml | 3 +++ .../product/inventory/InventoryServicesScript.groovy | 16 ++++++++++++++++ 7 files changed, 43 insertions(+) diff --git a/applications/product/servicedef/services.xml b/applications/product/servicedef/services.xml index c321436dc2..f51d2e4e35 100644 --- a/applications/product/servicedef/services.xml +++ b/applications/product/servicedef/services.xml @@ -306,6 +306,7 @@ under the License. <!-- Product PaymentMethodType Services --> <service name="createProductPaymentMethodType" default-entity-name="ProductPaymentMethodType" engine="entity-auto" invoke="create" auth="true"> <description>Create an ProductPaymentMethodType</description> + <permission-service service-name="productGenericPermission" main-action="CREATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> <override name="fromDate" optional="true"/> @@ -1608,6 +1609,7 @@ under the License. <service name="createProductGroupOrder" default-entity-name="ProductGroupOrder" engine="groovy" location="component://product/src/main/groovy/org/apache/ofbiz/product/product/product/ProductServicesScript.groovy" invoke="createProductGroupOrder" auth="true"> <description>Create ProductGroupOrder</description> + <permission-service service-name="productGenericPermission" main-action="CREATE"/> <auto-attributes include="pk" mode="OUT" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> diff --git a/applications/product/servicedef/services_cost.xml b/applications/product/servicedef/services_cost.xml index 02859c582f..dd88461f55 100644 --- a/applications/product/servicedef/services_cost.xml +++ b/applications/product/servicedef/services_cost.xml @@ -26,17 +26,20 @@ under the License. <service name="createCostComponent" default-entity-name="CostComponent" engine="entity-auto" invoke="create" auth="true"> <description>Create a CostComponent</description> + <permission-service service-name="productGenericPermission" main-action="CREATE"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> <auto-attributes include="pk" mode="OUT" optional="false"/> <!--<override name="costComponentTypeId" optional="false"/>--> </service> <service name="updateCostComponent" default-entity-name="CostComponent" engine="entity-auto" invoke="update" auth="true"> <description>Update a CostComponent</description> + <permission-service service-name="productGenericPermission" main-action="UPDATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> <service name="deleteCostComponent" default-entity-name="CostComponent" engine="entity-auto" invoke="delete" auth="true"> <description>Delete a CostComponent</description> + <permission-service service-name="productGenericPermission" main-action="DELETE"/> <auto-attributes include="pk" mode="IN" optional="false"/> </service> <service name="recreateCostComponent" default-entity-name="CostComponent" engine="groovy" @@ -55,16 +58,19 @@ under the License. </service> <service name="createProductCostComponentCalc" default-entity-name="ProductCostComponentCalc" engine="entity-auto" invoke="create" auth="true"> <description>Create a ProductCostComponentCalc</description> + <permission-service service-name="productGenericPermission" main-action="CREATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> <service name="updateProductCostComponentCalc" default-entity-name="ProductCostComponentCalc" engine="entity-auto" invoke="update" auth="true"> <description>Update a ProductCostComponentCalc</description> + <permission-service service-name="productGenericPermission" main-action="UPDATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> <service name="deleteProductCostComponentCalc" default-entity-name="ProductCostComponentCalc" engine="entity-auto" invoke="delete" auth="true"> <description>Delete a Example</description> + <permission-service service-name="productGenericPermission" main-action="DELETE"/> <auto-attributes include="pk" mode="IN" optional="false"/> </service> <service name="getProductCost" engine="groovy" auth="true" diff --git a/applications/product/servicedef/services_facility.xml b/applications/product/servicedef/services_facility.xml index e4c627c7f6..44a93e6edb 100644 --- a/applications/product/servicedef/services_facility.xml +++ b/applications/product/servicedef/services_facility.xml @@ -34,6 +34,11 @@ under the License. <description>ProductFacility Permission Checking Logic</description> <implements service="permissionInterface"/> </service> + <service name="orderInventoryPermissionCheck" engine="groovy" + location="component://product/src/main/groovy/org/apache/ofbiz/product/product/inventory/InventoryServicesScript.groovy" invoke="orderInventoryPermissionCheck"> + <description>Permission logic for order-related inventory reservation services</description> + <implements service="permissionInterface"/> + </service> <!-- Product Inventory Services --> <service name="createInventoryItem" default-entity-name="InventoryItem" engine="groovy" location="component://product/src/main/groovy/org/apache/ofbiz/product/product/inventory/InventoryServicesScript.groovy" invoke="createInventoryItem" auth="true"> @@ -397,6 +402,7 @@ under the License. <service name="balanceInventoryItems" engine="simple" transaction-timeout="600" location="component://product/minilang/product/inventory/InventoryServices.xml" invoke="balanceInventoryItems" auth="true"> <description>Balance inventory items based on the new item specified which will have available inventory that back-order (negative ATP) reservations can be reassigned to.</description> + <permission-service service-name="orderInventoryPermissionCheck" main-action="UPDATE"/> <attribute name="inventoryItemId" type="String" mode="IN" optional="false"> <type-validate> <fail-property resource="ProductErrorUiLabels" property="facility.inventoryItemId"/> @@ -1288,6 +1294,7 @@ under the License. <service name="setOrderReservationPriority" engine="simple" invoke="setOrderReservationPriority" location="component://product/minilang/product/inventory/InventoryServices.xml" auth="true"> <description>set order priority</description> + <permission-service service-name="orderInventoryPermissionCheck" main-action="UPDATE"/> <attribute name="priority" mode="IN" type="String" optional="true"/> <attribute name="orderId" mode="IN" type="String" optional="false"/> </service> diff --git a/applications/product/servicedef/services_pricepromo.xml b/applications/product/servicedef/services_pricepromo.xml index 83f0ec0b9b..a00ad8307c 100644 --- a/applications/product/servicedef/services_pricepromo.xml +++ b/applications/product/servicedef/services_pricepromo.xml @@ -113,17 +113,20 @@ under the License. <service name="createProductPriceAction" default-entity-name="ProductPriceAction" engine="entity-auto" invoke="create" auth="true"> <description>Create a ProductPriceAction</description> + <permission-service service-name="productPriceGenericPermission" main-action="CREATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> <override name="productPriceActionSeqId" mode="OUT"/> </service> <service name="updateProductPriceAction" default-entity-name="ProductPriceAction" engine="entity-auto" invoke="update" auth="true"> <description>Update a ProductPriceAction</description> + <permission-service service-name="productPriceGenericPermission" main-action="UPDATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> <service name="deleteProductPriceAction" default-entity-name="ProductPriceAction" engine="entity-auto" invoke="delete" auth="true"> <description>Delete a ProductPriceAction</description> + <permission-service service-name="productPriceGenericPermission" main-action="DELETE"/> <auto-attributes include="pk" mode="IN" optional="false"/> </service> diff --git a/applications/product/servicedef/services_shipment.xml b/applications/product/servicedef/services_shipment.xml index e82629763f..45a5da73c0 100644 --- a/applications/product/servicedef/services_shipment.xml +++ b/applications/product/servicedef/services_shipment.xml @@ -27,11 +27,13 @@ under the License. <!-- Shipment Services --> <service name="createCarrierShipmentMethod" engine="entity-auto" default-entity-name="CarrierShipmentMethod" invoke="create" auth="true"> <description>Creates A CarrierShipmentMethod</description> + <permission-service service-name="productGenericPermission" main-action="CREATE"/> <auto-attributes entity-name="CarrierShipmentMethod" include="pk" mode="IN" optional="false"/> <auto-attributes entity-name="CarrierShipmentMethod" include="nonpk" mode="IN" optional="true"/> </service> <service name="updateCarrierShipmentMethod" engine="entity-auto" default-entity-name="CarrierShipmentMethod" invoke="update" auth="true"> <description>Updates A CarrierShipmentMethod</description> + <permission-service service-name="productGenericPermission" main-action="UPDATE"/> <auto-attributes entity-name="CarrierShipmentMethod" include="pk" mode="IN" optional="false"/> <auto-attributes entity-name="CarrierShipmentMethod" include="nonpk" mode="IN" optional="true"/> </service> @@ -46,6 +48,7 @@ under the License. </service> <service name="updateShipmentMethodType" engine="entity-auto" default-entity-name="ShipmentMethodType" invoke="update" auth="true"> <description>Updates A ShipmentMethodType</description> + <permission-service service-name="productGenericPermission" main-action="UPDATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> @@ -956,6 +959,7 @@ under the License. <service name="removeShipmentEstimate" engine="java" location="org.apache.ofbiz.shipment.shipment.ShipmentServices" invoke="removeShipmentEstimate" auth="true"> <description>Remove Shipment Estimate</description> + <permission-service service-name="productGenericPermission" main-action="DELETE"/> <attribute name="shipmentCostEstimateId" type="String" mode="IN" optional="false"/> </service> @@ -1246,6 +1250,7 @@ under the License. </service> <service name="updateShipmentTimeEstimate" engine="entity-auto" invoke="update" default-entity-name="ShipmentTimeEstimate" auth="true"> <description>Update a ShipmentTimeEstimate</description> + <permission-service service-name="productGenericPermission" main-action="UPDATE"/> <auto-attributes include="pk" mode="IN"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> @@ -1255,6 +1260,7 @@ under the License. </service> <service name="expireShipmentTimeEstimate" engine="entity-auto" invoke="expire" default-entity-name="ShipmentTimeEstimate" auth="true"> <description>Expire a ShipmentTimeEstimate</description> + <permission-service service-name="productGenericPermission" main-action="UPDATE"/> <auto-attributes include="pk" mode="IN"/> </service> diff --git a/applications/product/servicedef/services_store.xml b/applications/product/servicedef/services_store.xml index a605b73715..329184255b 100644 --- a/applications/product/servicedef/services_store.xml +++ b/applications/product/servicedef/services_store.xml @@ -376,11 +376,13 @@ under the License. <!--ProductStoreGroup Services --> <service name="createProductStoreGroup" default-entity-name="ProductStoreGroup" engine="entity-auto" invoke="create" auth="true"> <description>Create a ProductStoreGroup</description> + <permission-service service-name="productStoreGenericPermission" main-action="CREATE"/> <auto-attributes include="pk" mode="OUT" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> <service name="updateProductStoreGroup" default-entity-name="ProductStoreGroup" engine="entity-auto" invoke="update" auth="true"> <description>Update a ProductStoreGroup</description> + <permission-service service-name="productStoreGenericPermission" main-action="UPDATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> @@ -390,6 +392,7 @@ under the License. </service> <service name="createProductStoreGroupMember" default-entity-name="ProductStoreGroupMember" engine="entity-auto" invoke="create" auth="true"> <description>Create a ProductStoreGroupMember</description> + <permission-service service-name="productStoreGenericPermission" main-action="CREATE"/> <auto-attributes include="pk" mode="IN" optional="false"/> <auto-attributes include="nonpk" mode="IN" optional="true"/> </service> diff --git a/applications/product/src/main/groovy/org/apache/ofbiz/product/product/inventory/InventoryServicesScript.groovy b/applications/product/src/main/groovy/org/apache/ofbiz/product/product/inventory/InventoryServicesScript.groovy index 904d9d639a..6fe8bbbeae 100644 --- a/applications/product/src/main/groovy/org/apache/ofbiz/product/product/inventory/InventoryServicesScript.groovy +++ b/applications/product/src/main/groovy/org/apache/ofbiz/product/product/inventory/InventoryServicesScript.groovy @@ -66,6 +66,22 @@ Map facilityGenericPermission() { return result } +/** + * Permission logic for order-related inventory reservation services (balanceInventoryItems, + * setOrderReservationPriority), which are reached through the order manager rather than the catalog. + * @return Map with hasPermission boolean and potential failure message. + */ +Map orderInventoryPermissionCheck() { + String mainAction = parameters.mainAction + require(mainAction as boolean, 'ProductUiLabels', 'ProductMissingMainActionInPermissionService') + Map result = success() + result.hasPermission = security.hasEntityPermission('ORDERMGR', "_${mainAction}", parameters.userLogin) + if (!result.hasPermission) { + result = failure('ProductUiLabels', 'ProductPermissionError') + } + return result +} + /** * ProductFacility Permission Checking Logic * @return Map with hasPermission boolean and potential failure message.
