This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 550d097c48 Fixed: updateContentPermission grants UPDATE via ancestor
ownership without an ownership change request (OFBIZ-13592)
550d097c48 is described below
commit 550d097c48d5f08cc4a3141c54a052668f02c1a6
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Sep 15 12:55:55 2026 +0530
Fixed: updateContentPermission grants UPDATE via ancestor ownership without
an ownership change request (OFBIZ-13592)
The minilang-to-Groovy conversion of updateContentPermission moved the
ancestor parent-walk block that checks ownership of a content's owner chain out
of the conditional block that verifies an explicit ownership reassignment is
being requested, making it run unconditionally whenever checkOwnership failed
on the content's current owner. This let a user who owns any ancestor in the
ownership chain update content they don't own and aren't reassigning ownership
of, bypassing the intended [...]
---
.../permission/ContentPermissionServices.groovy | 28 +++++++++++-----------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git
a/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
b/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
index 6934bd65aa..1e217ec2d9 100644
---
a/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
+++
b/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
@@ -289,20 +289,20 @@ Map updateContentPermission(Boolean hasPermission, String
contentId, String owne
parameters.checkId = checkId
Map serviceResultCO = run service: 'checkOwnership', with:
parameters
hasPermission = serviceResultCO.hasPermission ?: false
- }
- if (!hasPermission) {
- // no permission on this parent; check the parent's parent(s)
- while (!hasPermission && checkId) {
- // iterate until either we have permission or there are no
more parents
- GenericValue currentContent =
from('Content').where(contentId: checkId).cache().queryOne()
- if (currentContent?.ownerContentId) {
- checkId = currentContent.ownerContentId
- parameters.checkId = checkId
- Map serviceResCO = run service: 'checkOwnership',
with: parameters
- hasPermission = serviceResCO.hasPermission ?: false
- } else {
- // no parent record found; time to stop recursion
- checkId = null
+ if (!hasPermission) {
+ // no permission on this parent; check the parent's
parent(s)
+ while (!hasPermission && checkId) {
+ // iterate until either we have permission or there
are no more parents
+ GenericValue currentContent =
from('Content').where(contentId: checkId).cache().queryOne()
+ if (currentContent?.ownerContentId) {
+ checkId = currentContent.ownerContentId
+ parameters.checkId = checkId
+ Map serviceResCO = run service: 'checkOwnership',
with: parameters
+ hasPermission = serviceResCO.hasPermission ?: false
+ } else {
+ // no parent record found; time to stop recursion
+ checkId = null
+ }
}
}
}
