(ofbiz-framework) branch release24.09 updated: Fixed: Hardens security by adding missing permission check in OrderServices (#2218)

[lfinster]

This is an automated email from the ASF dual-hosted git repository.

Lukas-Finster pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 0749c835f0 Fixed: Hardens security by adding missing permission check 
in OrderServices (#2218)
0749c835f0 is described below

commit 0749c835f0f3905364f9692fafac8a284aa97d60
Author: Lukas-Finster <lukas.fins...@ecomify.de>
AuthorDate: Thu Oct 8 08:41:49 2026 +0200

    Fixed: Hardens security by adding missing permission check in OrderServices 
(#2218)
---
 .../src/main/java/org/apache/ofbiz/order/order/OrderServices.java  | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
index d8ef11f220..09f0d2affc 100644
--- 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
+++ 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
@@ -3881,6 +3881,13 @@ public class OrderServices {
         GenericValue userLogin = (GenericValue) context.get("userLogin");
         Locale locale = (Locale) context.get("locale");
         String orderId = (String) context.get("orderId");
+        Security security = dctx.getSecurity();
+
+        if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE", 
security, delegator)) {
+            return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
+                    "OrderYouDoNotHavePermissionToChangeThisOrdersStatus", 
locale));
+        }
+
         Map<String, String> overridePriceMap = 
UtilGenerics.cast(context.get("overridePriceMap"));
         Map<String, String> itemDescriptionMap = 
UtilGenerics.cast(context.get("itemDescriptionMap"));
         Map<String, String> itemPriceMap = 
UtilGenerics.cast(context.get("itemPriceMap"));