(ofbiz-framework) branch release24.09 updated: Fixed: Enforces order-update authorization in updateShipGroupShipInfo and addItemToApprovedOrder

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 5297b1fc39 Fixed: Enforces order-update authorization in 
updateShipGroupShipInfo and addItemToApprovedOrder
5297b1fc39 is described below

commit 5297b1fc39beb1ca9afacda7e5752c1232a86b33
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sun Oct 18 18:37:22 2026 +0530

    Fixed: Enforces order-update authorization in updateShipGroupShipInfo and 
addItemToApprovedOrder
    
    - Requires the standard order-update authorization in 
updateShipGroupShipInfo before the order is loaded into a cart for update, 
matching the pattern already used by updateApprovedOrderItems.
    - Requires the same authorization in addItemToApprovedOrder (service 
appendOrderItem) before an item is appended to an existing order.
---
 .../java/org/apache/ofbiz/order/order/OrderServices.java     | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
index 0fc7bcd3de..11cf7609bb 100644
--- 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
+++ 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
@@ -3734,6 +3734,12 @@ public class OrderServices {
         String changeComments = (String) context.get("changeComments");
         Boolean calcTax = (Boolean) context.get("calcTax");
         Map<String, String> itemAttributesMap = 
UtilGenerics.cast(context.get("itemAttributesMap"));
+        Security security = dctx.getSecurity();
+
+        if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE", 
security, delegator)) {
+            return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+                    "OrderYouDoNotHavePermissionToChangeThisOrdersStatus", 
locale));
+        }
 
         if (calcTax == null) {
             calcTax = Boolean.TRUE;
@@ -6686,6 +6692,12 @@ public class OrderServices {
         String contactMechId = (String) context.get("contactMechId");
         String oldContactMechId = (String) context.get("oldContactMechId");
         String shipmentMethod = (String) context.get("shipmentMethod");
+        Security security = dctx.getSecurity();
+
+        if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE", 
security, delegator)) {
+            return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+                    "OrderYouDoNotHavePermissionToChangeThisOrdersStatus", 
locale));
+        }
 
         //load cart from order to update new shipping method or address
         ShoppingCart shoppingCart = null;