This is an automated email from the ASF dual-hosted git repository. mridulpathak pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit cbcf0da0e930497a098370a44df4f07dae6cf800 Author: Mridul Pathak <[email protected]> AuthorDate: Mon Oct 26 13:47:00 2026 +0530 Fix internal callers and a test fixture broken by the new createRequirement permission check - ProductionRunTests#testCreateProductionRunForRequirement calls createRequirement as TestSupplyAdmin, whose SUPPLYADMIN test security group lacked ORDERMGR_CREATE; added it, matching the group's stated scope of executing requirement-based manufacturing tasks - ProposedOrder.java (MRP) now runs its internal createRequirement call as the system user, since auto-generating a requirement during an MRP run is a trusted side effect, not an action on behalf of a specific user - workeffort/servicedef/secas.xml: createWorkEffortRequestItem and createWorkRequirementFulfillment now run their createCustRequestItem/createRequirement ECA actions as the system user --- .../main/java/org/apache/ofbiz/manufacturing/mrp/ProposedOrder.java | 6 +++++- applications/manufacturing/testdef/data/ManufacturingTestsData.xml | 1 + applications/workeffort/servicedef/secas.xml | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/applications/manufacturing/src/main/java/org/apache/ofbiz/manufacturing/mrp/ProposedOrder.java b/applications/manufacturing/src/main/java/org/apache/ofbiz/manufacturing/mrp/ProposedOrder.java index 7311c12f76..6ed6d9b48b 100644 --- a/applications/manufacturing/src/main/java/org/apache/ofbiz/manufacturing/mrp/ProposedOrder.java +++ b/applications/manufacturing/src/main/java/org/apache/ofbiz/manufacturing/mrp/ProposedOrder.java @@ -311,6 +311,10 @@ public class ProposedOrder { parameters.put("description", "Automatically generated by MRP"); } try { + // createRequirement requires ORDERMGR_CREATE; run as the "system" user since this is a trusted side effect of + // an already-permitted MRP run, not an action taken on behalf of the caller + parameters.put("userLogin", EntityQuery.use(delegator).from("UserLogin") + .where("userLoginId", "system").cache().queryOne()); Map<String, Object> result = dispatcher.runSync("createRequirement", parameters); if (ServiceUtil.isError(result)) { String errorMessage = ServiceUtil.getErrorMessage(result); @@ -318,7 +322,7 @@ public class ProposedOrder { return null; } return (String) result.get("requirementId"); - } catch (GenericServiceException e) { + } catch (GenericServiceException | GenericEntityException e) { Debug.logError(e, "Error : createRequirement with parameters = " + parameters + "--" + e.getMessage(), MODULE); return null; } diff --git a/applications/manufacturing/testdef/data/ManufacturingTestsData.xml b/applications/manufacturing/testdef/data/ManufacturingTestsData.xml index a4002d314e..359a5acf68 100644 --- a/applications/manufacturing/testdef/data/ManufacturingTestsData.xml +++ b/applications/manufacturing/testdef/data/ManufacturingTestsData.xml @@ -42,6 +42,7 @@ under the License. <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPPLYADMIN" permissionId="WORKEFFORTMGR_CREATE"/> <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPPLYADMIN" permissionId="WORKEFFORTMGR_UPDATE"/> <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPPLYADMIN" permissionId="ACCOUNTING_CREATE"/> + <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPPLYADMIN" permissionId="ORDERMGR_CREATE"/> <Party partyId="TestSupplyAdmin" partyTypeId="PERSON"/> <Person partyId="TestSupplyAdmin" firstName="Supply" lastName="Admin"/> <UserLogin partyId="TestSupplyAdmin" userLoginId="TestSupplyAdmin" userFullName="Supply Admin"/> diff --git a/applications/workeffort/servicedef/secas.xml b/applications/workeffort/servicedef/secas.xml index 80e08c3fcb..b9a2281267 100644 --- a/applications/workeffort/servicedef/secas.xml +++ b/applications/workeffort/servicedef/secas.xml @@ -52,7 +52,7 @@ under the License. </eca> <eca service="createWorkEffortRequestItem" event="invoke"> <condition field-name="custRequestItemExists" operator="is-empty"/> - <action service="createCustRequestItem" mode="sync"/> + <action service="createCustRequestItem" mode="sync" run-as-user="system"/> </eca> <eca service="createWorkEffortQuote" event="invoke"> <condition field-name="quoteId" operator="is-empty"/> @@ -60,7 +60,7 @@ under the License. </eca> <eca service="createWorkRequirementFulfillment" event="invoke"> <condition field-name="requirementId" operator="is-empty"/> - <action service="createRequirement" mode="sync"/> + <action service="createRequirement" mode="sync" run-as-user="system"/> </eca> <eca service="createShoppingListWorkEffort" event="invoke"> <condition field-name="shoppingListId" operator="is-empty"/>
