This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new c667dcfae6 Fixed: Enforces order-update authorization in
updateOrderPaymentPreference
c667dcfae6 is described below
commit c667dcfae6972aa090c37909934a3ea222e8b73a
Author: Mridul Pathak <[email protected]>
AuthorDate: Fri Oct 9 14:36:52 2026 +0530
Fixed: Enforces order-update authorization in updateOrderPaymentPreference
- Resolves the parent orderId from the loaded OrderPaymentPreference
(never from caller-supplied context) and requires the standard
order-update authorization before changing its status, matching
the pattern already used by sibling order-mutation methods.
- Guards against a missing OrderPaymentPreference lookup.
- Prevents a newly-cloned OrderPaymentPreference from being attached
to a different order via a caller-supplied orderId.
---
.../org/apache/ofbiz/order/order/OrderServices.java | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
index 49dfed97dd..f6146c95aa 100644
---
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
+++
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
@@ -5311,6 +5311,9 @@ public class OrderServices {
public static Map<String, Object>
updateOrderPaymentPreference(DispatchContext dctx, Map<String, ? extends
Object> context) {
Delegator delegator = dctx.getDelegator();
+ Security security = dctx.getSecurity();
+ GenericValue userLogin = (GenericValue) context.get("userLogin");
+ Locale locale = (Locale) context.get("locale");
String orderPaymentPreferenceId = (String)
context.get("orderPaymentPreferenceId");
String checkOutPaymentId = (String) context.get("checkOutPaymentId");
String statusId = (String) context.get("statusId");
@@ -5318,6 +5321,18 @@ public class OrderServices {
try {
GenericValue opp =
EntityQuery.use(delegator).from("OrderPaymentPreference").where("orderPaymentPreferenceId",
orderPaymentPreferenceId)
.queryOne();
+ if (opp == null) {
+ return ServiceUtil.returnError("Cannot find
OrderPaymentPreference with orderPaymentPreferenceId: " +
orderPaymentPreferenceId);
+ }
+
+ // the orderId on the referenced OrderPaymentPreference is the
only trustworthy source of the parent
+ // order; never trust an orderId supplied in the context, since it
is not validated against opp
+ String orderId = opp.getString("orderId");
+ if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE",
security, delegator)) {
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+ "OrderYouDoNotHavePermissionToChangeThisOrdersStatus",
locale));
+ }
+
String paymentMethodId = null;
String paymentMethodTypeId = null;
@@ -5353,6 +5368,9 @@ public class OrderServices {
newOpp.set("paymentMethodId", paymentMethodId);
newOpp.set("paymentMethodTypeId", paymentMethodTypeId);
newOpp.setNonPKFields(context);
+ // setNonPKFields above applies the caller-supplied orderId
from context; re-assert the
+ // authorized orderId so the new OrderPaymentPreference cannot
be attached to a different order
+ newOpp.set("orderId", orderId);
newOpp.create();
results.put("orderPaymentPreferenceId",
newOpp.get("orderPaymentPreferenceId"));
}
