This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 5682245669 Fixed: createReturnItem() does not cap returnPrice to
returnablePrice for non-privileged callers
5682245669 is described below
commit 5682245669a233288eb1fb47dc0e12cc0f39b021
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Sep 22 12:57:36 2026 +0530
Fixed: createReturnItem() does not cap returnPrice to returnablePrice for
non-privileged callers
In createReturnItem(), non-privileged callers (those without
ORDERMGR_CREATE) are documented to have their returnPrice capped to the
server-computed returnablePrice. The assignment was overwriting returnablePrice
with the caller-supplied parameters.returnPrice instead of the other way
around, so the subsequent ceiling check compared the input against itself. This
restores the intended assignment direction, matching the original mini-lang
logic prior to its Groovy conversion.
---
.../org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git
a/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
b/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
index b1d2be5576..9f8af58dde 100644
---
a/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
+++
b/applications/order/src/main/groovy/org/apache/ofbiz/order/order/OrderReturnServicesScript.groovy
@@ -232,7 +232,7 @@ Map createReturnItem() {
// the user is only allowed to set a returnPrice if he has
ORDERMGR_CREATE privilege,
// otherwise only the returnablePrice calculated by service is used
if (!security.hasEntityPermission('ORDERMGR', '_CREATE',
parameters.userLogin)) {
- returnablePrice = parameters.returnPrice
+ parameters.returnPrice = returnablePrice
}
// make sure the returnQuantity is not greater than the
returnableQuantity
// from service or the quantity on the original orderItem
