(ofbiz-framework) branch trunk updated: Fixed: Add permission check for runAsSystemUser in CoreEvents

[jacopoc]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new c8d9f4868e Fixed: Add permission check for runAsSystemUser in 
CoreEvents
c8d9f4868e is described below

commit c8d9f4868e82a0faab8d6b010d8f20d2454421df
Author: Jacopo Cappellato <jacopo.cappell...@gmail.com>
AuthorDate: Fri May 8 19:16:58 2026 +0200

    Fixed: Add permission check for runAsSystemUser in CoreEvents
---
 .../webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git 
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java 
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
index 07166a68f2..acffefec86 100644
--- 
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
+++ 
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
@@ -125,6 +125,9 @@ public class CoreEvents {
         String serviceCnt = (String) params.remove("SERVICE_COUNT");
         String retryCnt = (String) params.remove("SERVICE_MAXRETRY");
         String runAsSystemUser = (String) 
params.remove("SERVICE_RUN_AS_SYSTEM");
+        if (!security.hasPermission("SERVICE_RSAS_VIEW", userLogin)) {
+            runAsSystemUser = "N";
+        }
 
         // the frequency map
         Map<String, Integer> freqMap = new HashMap<>();