This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 1a1d9c1132 Fixed: Add permission checks to WebAnalyticsConfig services
1a1d9c1132 is described below
commit 1a1d9c1132107dc416f37657b555f4a6d7b30a51
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Oct 14 18:59:09 2026 +0530
Fixed: Add permission checks to WebAnalyticsConfig services
The create, update and delete WebAnalyticsConfig services had no
permission-service, so any user able to reach the Content application could
manage web analytics configurations. They now require the matching CONTENTMGR
permission through contentManagerPermission, consistent with the WebSite
services.
---
applications/product/servicedef/services.xml | 3 +++
1 file changed, 3 insertions(+)
diff --git a/applications/product/servicedef/services.xml
b/applications/product/servicedef/services.xml
index 7e4049ac9e..c321436dc2 100644
--- a/applications/product/servicedef/services.xml
+++ b/applications/product/servicedef/services.xml
@@ -1319,16 +1319,19 @@ under the License.
<!-- Start Web Analytics configuration services -->
<service name="createWebAnalyticsConfig"
default-entity-name="WebAnalyticsConfig" engine="entity-auto" invoke="create"
auth="true">
<description>Create a WebAnalyticsConfig</description>
+ <permission-service service-name="contentManagerPermission"
main-action="CREATE"/>
<auto-attributes include="pk" mode="IN" optional="false"/>
<auto-attributes include="nonpk" mode="IN" optional="true"/>
</service>
<service name="updateWebAnalyticsConfig"
default-entity-name="WebAnalyticsConfig" engine="entity-auto" invoke="update"
auth="true">
<description>Update a WebAnalyticsConfig</description>
+ <permission-service service-name="contentManagerPermission"
main-action="UPDATE"/>
<auto-attributes include="pk" mode="IN" optional="false"/>
<auto-attributes include="nonpk" mode="IN" optional="true"/>
</service>
<service name="deleteWebAnalyticsConfig"
default-entity-name="WebAnalyticsConfig" engine="entity-auto" invoke="delete"
auth="true">
<description>Delete a WebAnalyticsConfig</description>
+ <permission-service service-name="contentManagerPermission"
main-action="DELETE"/>
<auto-attributes include="pk" mode="IN" optional="false"/>
</service>
