This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new cd3736207f Fixed: updateContactList does not enforce marketing UPDATE
permission (OFBIZ-13672)
cd3736207f is described below
commit cd3736207f80b26ef364c5ecd13f3113848e0aa5
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Oct 13 12:24:10 2026 +0530
Fixed: updateContactList does not enforce marketing UPDATE permission
(OFBIZ-13672)
createContactList and removeContactList both require a
marketingPermissionService permission check, but updateContactList does not,
letting any authenticated user modify an arbitrary ContactList record.
---
applications/marketing/servicedef/services.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/applications/marketing/servicedef/services.xml
b/applications/marketing/servicedef/services.xml
index 2fa603ccf7..bde56d4320 100644
--- a/applications/marketing/servicedef/services.xml
+++ b/applications/marketing/servicedef/services.xml
@@ -169,6 +169,7 @@ under the License.
</service>
<service name="updateContactList" default-entity-name="ContactList"
engine="entity-auto" invoke="update" auth="true">
<description>Update a ContactList record</description>
+ <permission-service service-name="marketingPermissionService"
main-action="UPDATE"/>
<auto-attributes include="pk" mode="IN" optional="false"/>
<auto-attributes include="nonpk" mode="IN" optional="true"/>
</service>
