(ofbiz-framework) branch release24.09 updated: Fixed: Check the owner of the shopping list in checkShoppingListSecurity

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new b8ff9f1df8 Fixed: Check the owner of the shopping list in 
checkShoppingListSecurity
b8ff9f1df8 is described below

commit b8ff9f1df8583d43444b20b823055bc185b027f3
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Tue Oct 20 13:52:46 2026 +0530

    Fixed: Check the owner of the shopping list in checkShoppingListSecurity
    
    checkShoppingListSecurity only compared the partyId passed to the service 
with the logged-in user, and did not look at who owns the shopping list being 
updated or removed. It now loads the list when a shoppingListId is passed and 
requires the logged-in user to be its owner or to have the PARTYMGR permission, 
as checkShoppingListItemSecurity already does for list items.
---
 applications/order/servicedef/services_shoppinglist.xml           | 1 +
 .../ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy    | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/applications/order/servicedef/services_shoppinglist.xml 
b/applications/order/servicedef/services_shoppinglist.xml
index 8e46990395..41eaac2f49 100644
--- a/applications/order/servicedef/services_shoppinglist.xml
+++ b/applications/order/servicedef/services_shoppinglist.xml
@@ -56,6 +56,7 @@ under the License.
         <description>Checks security on a ShoppingList</description>
         <implements service="permissionInterface"/>
         <attribute name="partyId" type="String" mode="IN" optional="true"/>
+        <attribute name="shoppingListId" type="String" mode="IN" 
optional="true"/>
     </service>
     <service name="calculateShoppingListDeepTotalPrice" engine="groovy" 
auth="true"
             
location="component://order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy"
 invoke="calculateShoppingListDeepTotalPrice">
diff --git 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
index adc83163b2..6b5caa56c1 100644
--- 
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
+++ 
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
@@ -225,6 +225,14 @@ Map calculateShoppingListDeepTotalPrice() {
  * Checks security on a ShoppingList
  */
 Map checkShoppingListSecurity() {
+    // for an existing list, check against its stored owner, not the partyId 
sent with the request
+    if (parameters.shoppingListId) {
+        GenericValue shoppingList = from('ShoppingList').where(shoppingListId: 
parameters.shoppingListId).queryOne()
+        if (shoppingList?.partyId && userLogin?.partyId != shoppingList.partyId
+                && !security.hasEntityPermission('PARTYMGR', 
"_${parameters.permissionAction}", parameters.userLogin)) {
+            return error(UtilProperties.getMessage('OrderErrorUiLabels', 
'OrderSecurityErrorToRunForAnotherParty', parameters.locale))
+        }
+    }
     if (userLogin && (userLogin.userLoginId != 'anonymous') &&
             parameters.partyId && (userLogin.partyId != parameters.partyId)
             && !security.hasEntityPermission('PARTYMGR', 
"_${parameters.permissionAction}", parameters.userLogin)) {