This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 1df4c4da15 Run internal createCustRequestItem calls as the system user
1df4c4da15 is described below
commit 1df4c4da153f0769ec9b7cf3825f26eac8c867bd
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Oct 26 19:25:10 2026 +0530
Run internal createCustRequestItem calls as the system user
createCustRequest and createCustRequestFromCart let a self-service caller
through custRequestPermissionCheck, then create the request's items under that
caller's userLogin, which the unconditional ORDERMGR_CRQ check now on
createCustRequestItem refuses. The items belong to the request the service has
just created, so that call now runs as the system user, as the workeffort ECA
already does.
---
.../order/minilang/request/CustRequestServices.xml | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/applications/order/minilang/request/CustRequestServices.xml
b/applications/order/minilang/request/CustRequestServices.xml
index ac6b16d3e5..b74855d223 100644
--- a/applications/order/minilang/request/CustRequestServices.xml
+++ b/applications/order/minilang/request/CustRequestServices.xml
@@ -101,9 +101,14 @@ under the License.
</or>
</condition>
<then>
+ <!-- the item belongs to the request just created, so
createCustRequestItem is run by the system user here -->
+ <entity-one entity-name="UserLogin"
value-field="systemUserLogin">
+ <field-map field-name="userLoginId" value="system"/>
+ </entity-one>
<set-service-fields service-name="createCustRequestItem"
map="parameters" to-map="createItem"/>
<set field="createItem.custRequestId"
from-field="newEntity.custRequestId"/>
- <call-service service-name="createCustRequestItem"
in-map-name="createItem"/>
+ <set field="createItem.userLogin"
from-field="systemUserLogin"/>
+ <call-service service-name="createCustRequestItem"
in-map-name="createItem" include-user-login="false"/>
</then>
</if>
@@ -309,7 +314,11 @@ under the License.
<check-errors/>
<entity-one entity-name="CustRequest" value-field="custRequest"
auto-field-map="true"/>
- <!-- create, for every cart item, a request item -->
+ <!-- create, for every cart item, a request item; the items belong to
the request just created, so
+ createCustRequestItem is run by the system user here -->
+ <entity-one entity-name="UserLogin" value-field="systemUserLogin">
+ <field-map field-name="userLoginId" value="system"/>
+ </entity-one>
<iterate list="items" entry="item">
<!-- a new request item is created -->
<clear-field field="createCustRequestItemInMap"/>
@@ -328,7 +337,8 @@ under the License.
<call-object-method obj-field="item"
method-name="getReservStart"
ret-field="createCustRequestItemInMap.reservStart"/>
<call-object-method obj-field="item"
method-name="getReservLength"
ret-field="createCustRequestItemInMap.reservLength"/>
<call-object-method obj-field="item"
method-name="getReservPersons"
ret-field="createCustRequestItemInMap.reservPersons"/>
- <call-service service-name="createCustRequestItem"
in-map-name="createCustRequestItemInMap">
+ <set field="createCustRequestItemInMap.userLogin"
from-field="systemUserLogin"/>
+ <call-service service-name="createCustRequestItem"
in-map-name="createCustRequestItemInMap" include-user-login="false">
<result-to-field result-name="custRequestItemSeqId"
field="custRequestItemSeqId"/>
</call-service>
</if-compare>
