(ofbiz-framework) branch release24.09 updated: Fixed: Party permission-check helper methods use incorrect logic (OFBIZ-13541)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 98966f9727 Fixed: Party permission-check helper methods use incorrect 
logic (OFBIZ-13541)
98966f9727 is described below

commit 98966f9727c429809b478ad73d1b6afd71a30df6
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Wed Sep 9 16:51:20 2026 +0530

    Fixed: Party permission-check helper methods use incorrect logic 
(OFBIZ-13541)
    
    - partyGroupPermissionCheck and partyRolePermissionCheck: call 
basePlusPartyIdPermissionCheck directly instead of delegating to 
partyStatusPermissionCheck, which was erroneously overwriting altPermission to 
PARTYMGR_STS and discarding the caller's intended PARTYMGR_GRP / PARTYMGR_ROLE 
permission check.
    - partyCommunicationEventPermissionCheck: restore the missing action == 
'CREATE' guard on the EMAIL_COMMUNICATION and COMMENT_NOTE branches so 
non-CREATE actions (such as UPDATE or DELETE) correctly fall through to the 
record ownership check.
---
 .../apache/ofbiz/party/party/PartyPermissionServices.groovy    | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git 
a/applications/party/src/main/groovy/org/apache/ofbiz/party/party/PartyPermissionServices.groovy
 
b/applications/party/src/main/groovy/org/apache/ofbiz/party/party/PartyPermissionServices.groovy
index e8d29dea5b..bb2efb2e20 100644
--- 
a/applications/party/src/main/groovy/org/apache/ofbiz/party/party/PartyPermissionServices.groovy
+++ 
b/applications/party/src/main/groovy/org/apache/ofbiz/party/party/PartyPermissionServices.groovy
@@ -97,7 +97,7 @@ Map partyStatusPermissionCheck() {
  */
 Map partyGroupPermissionCheck() {
     parameters.altPermission = 'PARTYMGR_GRP'
-    Map result = run service: 'partyStatusPermissionCheck', with: parameters
+    Map result = basePlusPartyIdPermissionCheck()
     return result
 }
 
@@ -117,7 +117,7 @@ Map partyDatasourcePermissionCheck() {
  */
 Map partyRolePermissionCheck() {
     parameters.altPermission = 'PARTYMGR_ROLE'
-    Map result = run service: 'partyStatusPermissionCheck', with: parameters
+    Map result = basePlusPartyIdPermissionCheck()
     return result
 }
 
@@ -259,9 +259,10 @@ Map cancelPartyInvitationPermissionCheck() {
  */
 Map partyCommunicationEventPermissionCheck() {
     Map result = success()
-    if (parameters.communicationEventTypeId == 'EMAIL_COMMUNICATION') {
+    String action = parameters.mainAction ?: parameters.action
+    if (parameters.communicationEventTypeId == 'EMAIL_COMMUNICATION' && action 
== 'CREATE') {
         parameters.altPermission = 'PARTYMGR_CME-EMAIL'
-    } else if (parameters.communicationEventTypeId == 'COMMENT_NOTE') {
+    } else if (parameters.communicationEventTypeId == 'COMMENT_NOTE' && action 
== 'CREATE') {
         parameters.altPermission = 'PARTYMGR_CME-NOTE'
     } else if (parameters.partyIdFrom != userLogin.partyId
             && parameters.partyIdTo != userLogin.partyId
@@ -271,6 +272,7 @@ Map partyCommunicationEventPermissionCheck() {
         result.hasPermission = true
     }
     if (!result.hasPermission) {
+        parameters.mainAction = action
         result = run service: 'basePermissionCheck', with: parameters
     }
     return result