(ofbiz-framework) branch trunk updated: Improved: deleteContentJson lets a caller without DELETE permission detach content and cascade-delete its alias subtree (#2099)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new d1238a2756 Improved: deleteContentJson lets a caller without DELETE 
permission detach content and cascade-delete its alias subtree (#2099)
d1238a2756 is described below

commit d1238a2756228c9eab0baaf0de4023508f142026
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Fri Sep 25 21:41:19 2026 +0530

    Improved: deleteContentJson lets a caller without DELETE permission detach 
content and cascade-delete its alias subtree (#2099)
    
    ContentJsonEvents.deleteContent (backing POST 
/content/control/deleteContentJson) performed no permission check at all before 
detaching a content item from every parent it's under and cascade-deleting the 
WebSitePathAlias records for its entire subtree, unlike the equivalent 
removeContentAssoc service, which requires genericContentPermission DELETE. Any 
authenticated user, including one with only view-only content roles, could call 
the endpoint directly and silently break live site na [...]
    
    This adds a DELETE permission check on the target content before performing 
the delete, mirroring what removeContentAssoc already requires for removing a 
single association.
---
 .../org/apache/ofbiz/content/cms/ContentJsonEvents.java  | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git 
a/applications/content/src/main/java/org/apache/ofbiz/content/cms/ContentJsonEvents.java
 
b/applications/content/src/main/java/org/apache/ofbiz/content/cms/ContentJsonEvents.java
index bc8bc7ca3b..ac0262c7d6 100644
--- 
a/applications/content/src/main/java/org/apache/ofbiz/content/cms/ContentJsonEvents.java
+++ 
b/applications/content/src/main/java/org/apache/ofbiz/content/cms/ContentJsonEvents.java
@@ -144,10 +144,24 @@ public class ContentJsonEvents {
         }
     }
 
-    public static String deleteContent(HttpServletRequest request, 
HttpServletResponse response) throws GenericEntityException {
+    public static String deleteContent(HttpServletRequest request, 
HttpServletResponse response)
+            throws GenericEntityException, GenericServiceException {
         Delegator delegator = (Delegator) request.getAttribute("delegator");
+        LocalDispatcher dispatcher = (LocalDispatcher) 
request.getAttribute("dispatcher");
+        HttpSession session = request.getSession();
+        GenericValue userLogin = (GenericValue) 
session.getAttribute("userLogin");
+        Locale locale = UtilHttp.getLocale(request);
         String contentId = request.getParameter("contentId");
 
+        // deleteContent detaches contentId from every parent it's under and 
cascade-deletes its
+        // whole WebSitePathAlias subtree, so it needs the same DELETE 
permission removeContentAssoc
+        // enforces for removing a single association
+        Map<String, Object> permSvcCtx = UtilMisc.toMap("userLogin", 
userLogin, "locale", locale, "mainAction", "DELETE", "contentId", contentId);
+        Map<String, Object> permSvcResp = 
dispatcher.runSync("genericContentPermission", permSvcCtx);
+        if (ServiceUtil.isError(permSvcResp) || 
!Boolean.TRUE.equals(permSvcResp.get("hasPermission"))) {
+            throw new GenericServiceException("Permission denied to delete 
content [" + contentId + "]");
+        }
+
         deleteContent(delegator, contentId);
 
         return "success";