This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new c48d0b683c Fixed: viewContentPermission() never propagates
roleEntity/roleEntityField (OFBIZ-13626)
c48d0b683c is described below
commit c48d0b683c1a0b810e7269114284682e871f1255
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Sep 29 20:31:34 2026 +0530
Fixed: viewContentPermission() never propagates roleEntity/roleEntityField
(OFBIZ-13626)
checkContentOperationSecurity() reads roleEntity/roleEntityField from the
parameters map instead of its own arguments. createContentPermission() and
updateContentPermission() both set those parameters keys before calling in;
viewContentPermission() never did, and the field isn't declared on
genericContentPermission's servicedef, so it was genuinely absent. Result: VIEW
was denied for any user with CONTENTMGR_ROLE but not full CONTENTMGR, on
essentially all content, via the _NA_ fallba [...]
---
.../apache/ofbiz/content/permission/ContentPermissionServices.groovy | 3 +++
1 file changed, 3 insertions(+)
diff --git
a/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
b/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
index 1e217ec2d9..5b756c9db9 100644
---
a/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
+++
b/applications/content/src/main/groovy/org/apache/ofbiz/content/permission/ContentPermissionServices.groovy
@@ -108,6 +108,9 @@ Map viewContentPermission(Boolean hasPermission, String
contentId, String conten
String contentPurposeTypeId, String roleEntity,
String roleEntityField) {
+ parameters.roleEntity = roleEntity
+ parameters.roleEntityField = roleEntityField
+
// if called directly check the main permission
if (!hasPermission) {
parameters.primaryPermission = 'CONTENTMGR'
