This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 5abe1a3be7 Improved: Add missing permission and path checks across
ImageManagementServices methods
5abe1a3be7 is described below
commit 5abe1a3be72f0f7c61b3b40b03870c1c243826be
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Aug 19 15:13:02 2026 +0530
Improved: Add missing permission and path checks across
ImageManagementServices methods
Backported from trunk (#1679).
---
.../imagemanagement/ImageManagementServices.java | 78 ++++++++++++++++++----
1 file changed, 64 insertions(+), 14 deletions(-)
diff --git
a/applications/product/src/main/java/org/apache/ofbiz/product/imagemanagement/ImageManagementServices.java
b/applications/product/src/main/java/org/apache/ofbiz/product/imagemanagement/ImageManagementServices.java
index 36616c1937..b4ae9875b5 100644
---
a/applications/product/src/main/java/org/apache/ofbiz/product/imagemanagement/ImageManagementServices.java
+++
b/applications/product/src/main/java/org/apache/ofbiz/product/imagemanagement/ImageManagementServices.java
@@ -55,6 +55,7 @@ import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityQuery;
import org.apache.ofbiz.entity.util.EntityUtil;
import org.apache.ofbiz.entity.util.EntityUtilProperties;
+import org.apache.ofbiz.security.Security;
import org.apache.ofbiz.service.DispatchContext;
import org.apache.ofbiz.service.GenericServiceException;
import org.apache.ofbiz.service.LocalDispatcher;
@@ -110,6 +111,13 @@ public class ImageManagementServices {
String imageResize = (String) context.get("imageResize");
Locale locale = (Locale) context.get("locale");
+ Security security = dctx.getSecurity();
+ if (!security.hasEntityPermission("IMAGE_MANAGEMENT", "_UPLOAD",
userLogin)) {
+ String errMsg = UtilProperties.getMessage(RES_ERROR,
"ProductImageManagementPermissionError", locale);
+ Debug.logError(errMsg, MODULE);
+ return ServiceUtil.returnError(errMsg);
+ }
+
if (UtilValidate.isNotEmpty(uploadFileName)) {
Debug.logInfo("================== This is about file: " +
uploadFileName + " ==================", MODULE);
String imageServerPath =
FlexibleStringExpander.expandString(EntityUtilProperties.getPropertyValue("catalog",
@@ -121,9 +129,14 @@ public class ImageManagementServices {
Path resolvedProductDir = Paths.get(imageServerPath,
productId).normalize();
if (!resolvedProductDir.startsWith(imageServerNormalizedPath)) {
Debug.logError("Path traversal attempt detected in image
management upload, productId: " + productId, MODULE);
- return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", resolvedProductDir.toString()), locale));
}
+ if (!isValidProductImageFileName(uploadFileName,
resolvedProductDir, delegator)) {
+ Debug.logError("Path traversal attempt detected in image
management upload, uploadFileName: " + uploadFileName, MODULE);
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
+ "ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", uploadFileName), locale));
+ }
String rootTargetDirectory = imageServerPath;
File rootTargetDir = new File(rootTargetDirectory);
if (!rootTargetDir.exists()) {
@@ -206,11 +219,11 @@ public class ImageManagementServices {
new File(tempFile.toString()).deleteOnExit();
} catch (FileNotFoundException e) {
Debug.logError(e, MODULE);
- return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", file.getAbsolutePath()), locale));
} catch (IOException e) {
Debug.logError(e, MODULE);
- return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteBinaryData",
UtilMisc.toMap("fileName", file.getAbsolutePath()), locale));
}
} else { // Scale Image in different sizes
@@ -233,11 +246,11 @@ public class ImageManagementServices {
new File(tempFile.toString()).deleteOnExit();
} catch (FileNotFoundException e) {
Debug.logError(e, MODULE);
- return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", fileOriginal.getAbsolutePath()), locale));
} catch (IOException e) {
Debug.logError(e, MODULE);
- return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteBinaryData",
UtilMisc.toMap("fileName", fileOriginal.getAbsolutePath()), locale));
}
@@ -339,6 +352,14 @@ public class ImageManagementServices {
String dataResourceName = (String) context.get("dataResourceName");
Delegator delegator = dctx.getDelegator();
Locale locale = (Locale) context.get("locale");
+ GenericValue userLogin = (GenericValue) context.get("userLogin");
+
+ Security security = dctx.getSecurity();
+ if (!security.hasPermission("IMAGE_MANAGEMENT_ADMIN", userLogin)) {
+ String errMsg = UtilProperties.getMessage(RES_ERROR,
"ProductImageManagementPermissionError", locale);
+ Debug.logError(errMsg, MODULE);
+ return ServiceUtil.returnError(errMsg);
+ }
try {
if (UtilValidate.isNotEmpty(contentId)) {
@@ -349,7 +370,7 @@ public class ImageManagementServices {
Path resolvedFilePath = Paths.get(imageServerPath, productId,
dataResourceName).normalize();
if (!resolvedFilePath.startsWith(imageServerNormalizedPath)) {
Debug.logError("Path traversal attempt detected in image
management remove, productId: " + productId, MODULE);
- return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", resolvedFilePath.toString()), locale));
}
File file = new File(imageServerPath + "/" + productId + "/" +
dataResourceName);
@@ -415,7 +436,7 @@ public class ImageManagementServices {
Path resolvedProductDir = Paths.get(imageServerPath,
productId).normalize();
if (!resolvedProductDir.startsWith(imageServerNormalizedPath)) {
Debug.logError("Path traversal attempt detected in image
management scale, productId: " + productId, MODULE);
- String errMsg = UtilProperties.getMessage(RES_ERROR,
+ String errMsg = UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", resolvedProductDir.toString()), locale);
result.put(ModelService.ERROR_MESSAGE, errMsg);
return result;
@@ -591,7 +612,7 @@ public class ImageManagementServices {
Path resolvedProductDir = Paths.get(imageServerPath,
productId).normalize();
if (!resolvedProductDir.startsWith(imageServerNormalizedPath)) {
Debug.logError("Path traversal attempt detected in image
management thumbnail, productId: " + productId, MODULE);
- return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", resolvedProductDir.toString()), locale));
}
@@ -652,12 +673,12 @@ public class ImageManagementServices {
new File(tempFile.toString()).deleteOnExit();
} catch (FileNotFoundException e) {
Debug.logError(e, MODULE);
- return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName",
fileOriginalThumb.getAbsolutePath()), locale));
} catch (IOException e) {
Debug.logError(e, MODULE);
- return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteBinaryData",
UtilMisc.toMap("fileName",
fileOriginalThumb.getAbsolutePath()), locale));
}
@@ -787,14 +808,25 @@ public class ImageManagementServices {
String contentId = (String) context.get("contentId");
String dataResourceName = (String) context.get("dataResourceName");
String width = (String) context.get("sizeWidth");
+ Security security = dctx.getSecurity();
+ if (!security.hasPermission("IMAGE_MANAGEMENT_ADMIN", userLogin)) {
+ String errMsg = UtilProperties.getMessage(RES_ERROR,
"ProductImageManagementPermissionError", locale);
+ Debug.logError(errMsg, MODULE);
+ return ServiceUtil.returnError(errMsg);
+ }
// Guard against path traversal via productId
Path imageServerNormalizedPath =
Paths.get(imageServerPath).normalize();
Path resolvedProductDir = Paths.get(imageServerPath,
productId).normalize();
if (!resolvedProductDir.startsWith(imageServerNormalizedPath)) {
Debug.logError("Path traversal attempt detected in create new
image thumbnail, productId: " + productId, MODULE);
- return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", resolvedProductDir.toString()), locale));
}
+ if (!isValidProductImageFileName(dataResourceName, resolvedProductDir,
delegator)) {
+ Debug.logError("Path traversal attempt detected in create new
image thumbnail, dataResourceName: " + dataResourceName, MODULE);
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
+ "ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", dataResourceName), locale));
+ }
String imageType = ".jpg";
int resizeWidth = Integer.parseInt(width);
int resizeHeight = resizeWidth;
@@ -860,6 +892,7 @@ public class ImageManagementServices {
public static Map<String, Object> resizeImageOfProduct(DispatchContext
dctx, Map<String, ? extends Object> context) {
Delegator delegator = dctx.getDelegator();
Locale locale = (Locale) context.get("locale");
+ GenericValue userLogin = (GenericValue) context.get("userLogin");
String imageServerPath =
FlexibleStringExpander.expandString(EntityUtilProperties.getPropertyValue("catalog",
"image.management.path", delegator), context);
String productId = (String) context.get("productId");
@@ -867,14 +900,25 @@ public class ImageManagementServices {
String width = (String) context.get("resizeWidth");
int resizeWidth = Integer.parseInt(width);
int resizeHeight = resizeWidth;
+ Security security = dctx.getSecurity();
+ if (!security.hasPermission("IMAGE_MANAGEMENT_ADMIN", userLogin)) {
+ String errMsg = UtilProperties.getMessage(RES_ERROR,
"ProductImageManagementPermissionError", locale);
+ Debug.logError(errMsg, MODULE);
+ return ServiceUtil.returnError(errMsg);
+ }
// Guard against path traversal via productId
Path imageServerNormalizedPath =
Paths.get(imageServerPath).normalize();
Path resolvedProductDir = Paths.get(imageServerPath,
productId).normalize();
if (!resolvedProductDir.startsWith(imageServerNormalizedPath)) {
Debug.logError("Path traversal attempt detected in resize image,
productId: " + productId, MODULE);
- return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", resolvedProductDir.toString()), locale));
}
+ if (!isValidProductImageFileName(dataResourceName, resolvedProductDir,
delegator)) {
+ Debug.logError("Path traversal attempt detected in resize image,
dataResourceName: " + dataResourceName, MODULE);
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
+ "ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", dataResourceName), locale));
+ }
try {
BufferedImage bufImg = ImageIO.read(new File(imageServerPath + "/"
+ productId + "/" + dataResourceName));
@@ -905,12 +949,18 @@ public class ImageManagementServices {
String productId = (String) context.get("productId");
String contentId = (String) context.get("contentId");
String filenameToUse = (String) context.get("drDataResourceName");
+ Security security = dctx.getSecurity();
+ if (!security.hasPermission("IMAGE_MANAGEMENT_ADMIN", userLogin)) {
+ String errMsg = UtilProperties.getMessage(RES_ERROR,
"ProductImageManagementPermissionError", locale);
+ Debug.logError(errMsg, MODULE);
+ return ServiceUtil.returnError(errMsg);
+ }
// Guard against path traversal via productId
Path imageServerNormalizedPath =
Paths.get(imageServerPath).normalize();
Path resolvedProductDir = Paths.get(imageServerPath,
productId).normalize();
if (!resolvedProductDir.startsWith(imageServerNormalizedPath)) {
Debug.logError("Path traversal attempt detected in rename image,
productId: " + productId, MODULE);
- return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", resolvedProductDir.toString()), locale));
}
// Guard against path traversal via drDataResourceName: it must
resolve to a plain file name
@@ -918,7 +968,7 @@ public class ImageManagementServices {
// and a supported image extension.
if (!isValidProductImageFileName(filenameToUse, resolvedProductDir,
delegator)) {
Debug.logError("Path traversal attempt detected in rename image,
drDataResourceName: " + filenameToUse, MODULE);
- return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ProductImageViewUnableWriteFile",
UtilMisc.toMap("fileName", filenameToUse), locale));
}
String imageType =
filenameToUse.substring(filenameToUse.lastIndexOf('.'));
