This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 6302c22681 Fixed: Quote service permission checks don't match original
design (OFBIZ-13526)
6302c22681 is described below
commit 6302c226812849be41f9c72c3406b45885a70de0
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Sep 8 21:42:57 2026 +0530
Fixed: Quote service permission checks don't match original design
(OFBIZ-13526)
- checkUpdateQuoteStatus: restored the dropped ORDERMGR/_UPDATE permission
check, so any authenticated user could no longer mark an arbitrary quote as
ordered.
- removeQuoteItem: restored the dropped ORDERMGR/_DELETE permission check,
so any authenticated user could no longer delete an arbitrary quote's line
items.
- createQuoteItem: made the permission check conditional again (only
required when the quote belongs to someone other than the caller), matching
every other ownership-aware check in this file; the unconditional check was
blocking customers from adding items to their own quotes.
- createQuoteAdjustment: restored the dropped ORDERMGR/_CREATE permission
check, so any authenticated user could no longer fabricate discount/surcharge
adjustments on an arbitrary quote.
All four labels already existed in OrderErrorUiLabels.xml from the original
minilang and just needed to be wired back in.
---
.../org/apache/ofbiz/order/quote/QuoteServicesScript.groovy | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git
a/applications/order/src/main/groovy/org/apache/ofbiz/order/quote/QuoteServicesScript.groovy
b/applications/order/src/main/groovy/org/apache/ofbiz/order/quote/QuoteServicesScript.groovy
index 1989aaad7d..ede91aa81b 100644
---
a/applications/order/src/main/groovy/org/apache/ofbiz/order/quote/QuoteServicesScript.groovy
+++
b/applications/order/src/main/groovy/org/apache/ofbiz/order/quote/QuoteServicesScript.groovy
@@ -36,6 +36,9 @@ import org.apache.ofbiz.service.ServiceUtil
* Set the Quote status to ordered.
*/
Map checkUpdateQuoteStatus() {
+ if (!security.hasEntityPermission('ORDERMGR', '_UPDATE', userLogin)) {
+ return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderSecurityErrorToRunCheckUpdateQuoteStatus', locale))
+ }
GenericValue quote = from('Quote').where(parameters).queryOne()
if (!quote) {
return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderQuoteDoesNotExists', locale))
@@ -326,7 +329,9 @@ Map createQuoteItem() {
if (!quote) {
return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderQuoteDoesNotExists', locale))
}
- if (!security.hasEntityPermission('ORDERMGR', '_CREATE', userLogin)) {
+ if (quote.partyId
+ && quote.partyId != userLogin.partyId
+ && !security.hasEntityPermission('ORDERMGR', '_CREATE',
userLogin)) {
return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderSecurityErrorToRunCreateQuoteItem', locale))
}
GenericValue quoteItem = delegator.makeValidValue('QuoteItem', parameters)
@@ -379,6 +384,9 @@ Map updateQuoteItem() {
* Remove a QuoteItem.
*/
Map removeQuoteItem() {
+ if (!security.hasEntityPermission('ORDERMGR', '_DELETE', userLogin)) {
+ return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderSecurityErrorToRunRemoveQuoteItem', locale))
+ }
Map pksQuoteItem = [quoteId: parameters.quoteId, quoteItemSeqId:
parameters.quoteItemSeqId]
GenericValue quoteItem = from('QuoteItem').where(pksQuoteItem).queryOne()
if (!quoteItem) {
@@ -711,6 +719,9 @@ Map createQuoteNote() {
* Create a Quote adjustment
*/
Map createQuoteAdjustment() {
+ if (!security.hasEntityPermission('ORDERMGR', '_CREATE', userLogin)) {
+ return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderSecurityErrorToRunCreateQuoteAdjustment', locale))
+ }
GenericValue quoteAdjustment = makeValue('QuoteAdjustment', parameters)
quoteAdjustment.quoteAdjustmentId =
delegator.getNextSeqId('QuoteAdjustment')
quoteAdjustment.createdByUserLogin = userLogin.userLoginId
