(ofbiz-framework) branch trunk updated: Fixed: Check that the dataResourceId belongs to the contentId in SimpleContentViewHandler

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 8b9358c167 Fixed: Check that the dataResourceId belongs to the 
contentId in SimpleContentViewHandler
8b9358c167 is described below

commit 8b9358c16702c1bd35f2dabc10c25228ef482dee
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Tue Oct 20 14:36:42 2026 +0530

    Fixed: Check that the dataResourceId belongs to the contentId in 
SimpleContentViewHandler
    
    When both contentId and dataResourceId are passed, SimpleContentViewHandler 
now verifies that the DataResource is the one referenced by the Content before 
streaming it, since the view permission check is done on the contentId.
---
 .../org/apache/ofbiz/content/view/SimpleContentViewHandler.java    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git 
a/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
 
b/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
index ddf4d2dbc8..14ffb96082 100644
--- 
a/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
+++ 
b/applications/content/src/main/java/org/apache/ofbiz/content/view/SimpleContentViewHandler.java
@@ -103,6 +103,13 @@ public class SimpleContentViewHandler extends 
AbstractViewHandler {
                 Debug.logVerbose("dataResourceId:" + dataResourceId, MODULE);
             }
             Delegator delegator = (Delegator) 
request.getAttribute("delegator");
+            if (UtilValidate.isNotEmpty(dataResourceId) && 
UtilValidate.isNotEmpty(contentId)) {
+                // the permission check below is done on the contentId, so the 
given dataResourceId must belong to that content
+                GenericValue content = 
EntityQuery.use(delegator).from("Content").where("contentId", 
contentId).cache().queryOne();
+                if (content == null || 
!dataResourceId.equals(content.getString("dataResourceId"))) {
+                    throw new ViewHandlerException("DataResource [" + 
dataResourceId + "] is not associated with Content [" + contentId + "]");
+                }
+            }
             if (UtilValidate.isEmpty(dataResourceId)) {
                 if (UtilValidate.isEmpty(contentRevisionSeqId)) {
                     if (UtilValidate.isEmpty(mapKey) && 
UtilValidate.isEmpty(contentAssocTypeId)) {