(ofbiz-framework) branch trunk updated: Fixed: productPriceGenericPermission ignores its own sub-check result (OFBIZ-13538)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 1622af5589 Fixed: productPriceGenericPermission ignores its own 
sub-check result (OFBIZ-13538)
1622af5589 is described below

commit 1622af55892ec0b9b8877b9cfd938cc5a9fd1f2a
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Wed Sep 9 11:53:36 2026 +0530

    Fixed: productPriceGenericPermission ignores its own sub-check result 
(OFBIZ-13538)
    
    - productPriceGenericPermission: wrapped checkProductRelatedPermission's 
return value in ServiceUtil.isSuccess() before ANDing it into hasPermission. 
The raw Map it returns is always truthy in Groovy (even on failure), so the 
product-scoped LTD_ADMIN/alternatePermissionRoot check was previously bypassed 
entirely for any caller holding CATALOG_PRICE_MAINT.
    - productGenericPermission and productPriceGenericPermission: fixed 
'fail(...)' to 'failure(...)', the correct GroovyBaseScript helper. 'fail' has 
never been a real method here (present since the original 2018 conversion 
commit), so any actual permission denial from either service crashed with a 
GenericServiceException instead of returning a clean failure response.
---
 .../ofbiz/product/product/product/ProductServicesScript.groovy     | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git 
a/applications/product/src/main/groovy/org/apache/ofbiz/product/product/product/ProductServicesScript.groovy
 
b/applications/product/src/main/groovy/org/apache/ofbiz/product/product/product/ProductServicesScript.groovy
index 5a03b964ee..dc9cac1635 100644
--- 
a/applications/product/src/main/groovy/org/apache/ofbiz/product/product/product/ProductServicesScript.groovy
+++ 
b/applications/product/src/main/groovy/org/apache/ofbiz/product/product/product/ProductServicesScript.groovy
@@ -621,7 +621,7 @@ Map productGenericPermission() {
     result.hasPermission = ServiceUtil.isSuccess(
             checkProductRelatedPermission(parameters.resourceDescription, 
parameters.mainAction))
     if (!result.hasPermission) {
-        result = fail(UtilProperties.getMessage('ProductUiLabels', 
'ProductPermissionError', parameters.locale))
+        result = failure(UtilProperties.getMessage('ProductUiLabels', 
'ProductPermissionError', parameters.locale))
     }
     return result
 }
@@ -641,9 +641,10 @@ Map productPriceGenericPermission() {
         result = error(UtilProperties.getMessage('ProductUiLabels',
                 'ProductPriceMaintPermissionError', parameters.locale))
     }
-    result.hasPermission = ServiceUtil.isSuccess(result) && 
checkProductRelatedPermission(parameters.resourceDescription, mainAction)
+    result.hasPermission = ServiceUtil.isSuccess(result) &&
+            
ServiceUtil.isSuccess(checkProductRelatedPermission(parameters.resourceDescription,
 mainAction))
     if (!result.hasPermission) {
-        result = fail(UtilProperties.getMessage('ProductUiLabels', 
'ProductPermissionError', parameters.locale))
+        result = failure(UtilProperties.getMessage('ProductUiLabels', 
'ProductPermissionError', parameters.locale))
     }
     return result
 }