This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 602da8fb26 Run internal createCustRequestItem calls as the system user
602da8fb26 is described below
commit 602da8fb26567c16fab1eadb5cc41cb423124dd4
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Oct 26 19:25:10 2026 +0530
Run internal createCustRequestItem calls as the system user
createCustRequest and createCustRequestFromCart let a self-service caller
through custRequestPermissionCheck, then create the request's items under that
caller's userLogin, which the unconditional ORDERMGR_CRQ check now on
createCustRequestItem refuses. The items belong to the request the service has
just created, so that call now runs as the system user, as the workeffort ECA
already does.
---
.../order/minilang/request/CustRequestServices.xml | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/applications/order/minilang/request/CustRequestServices.xml
b/applications/order/minilang/request/CustRequestServices.xml
index ac6b16d3e5..b74855d223 100644
--- a/applications/order/minilang/request/CustRequestServices.xml
+++ b/applications/order/minilang/request/CustRequestServices.xml
@@ -101,9 +101,14 @@ under the License.
</or>
</condition>
<then>
+ <!-- the item belongs to the request just created, so
createCustRequestItem is run by the system user here -->
+ <entity-one entity-name="UserLogin"
value-field="systemUserLogin">
+ <field-map field-name="userLoginId" value="system"/>
+ </entity-one>
<set-service-fields service-name="createCustRequestItem"
map="parameters" to-map="createItem"/>
<set field="createItem.custRequestId"
from-field="newEntity.custRequestId"/>
- <call-service service-name="createCustRequestItem"
in-map-name="createItem"/>
+ <set field="createItem.userLogin"
from-field="systemUserLogin"/>
+ <call-service service-name="createCustRequestItem"
in-map-name="createItem" include-user-login="false"/>
</then>
</if>
@@ -309,7 +314,11 @@ under the License.
<check-errors/>
<entity-one entity-name="CustRequest" value-field="custRequest"
auto-field-map="true"/>
- <!-- create, for every cart item, a request item -->
+ <!-- create, for every cart item, a request item; the items belong to
the request just created, so
+ createCustRequestItem is run by the system user here -->
+ <entity-one entity-name="UserLogin" value-field="systemUserLogin">
+ <field-map field-name="userLoginId" value="system"/>
+ </entity-one>
<iterate list="items" entry="item">
<!-- a new request item is created -->
<clear-field field="createCustRequestItemInMap"/>
@@ -328,7 +337,8 @@ under the License.
<call-object-method obj-field="item"
method-name="getReservStart"
ret-field="createCustRequestItemInMap.reservStart"/>
<call-object-method obj-field="item"
method-name="getReservLength"
ret-field="createCustRequestItemInMap.reservLength"/>
<call-object-method obj-field="item"
method-name="getReservPersons"
ret-field="createCustRequestItemInMap.reservPersons"/>
- <call-service service-name="createCustRequestItem"
in-map-name="createCustRequestItemInMap">
+ <set field="createCustRequestItemInMap.userLogin"
from-field="systemUserLogin"/>
+ <call-service service-name="createCustRequestItem"
in-map-name="createCustRequestItemInMap" include-user-login="false">
<result-to-field result-name="custRequestItemSeqId"
field="custRequestItemSeqId"/>
</call-service>
</if-compare>
