This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new cc687ca4b5 Fixed: Check ownership of the order, payment method and
shipping address used by shopping lists (OFBIZ-13701)
cc687ca4b5 is described below
commit cc687ca4b5804c55eb1fd676d95f019396467947
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Oct 21 11:03:10 2026 +0530
Fixed: Check ownership of the order, payment method and shipping address
used by shopping lists (OFBIZ-13701)
- makeShoppingListFromOrder now requires the ORDERMGR_VIEW permission or
the PLACING_CUSTOMER role on the order, and otherwise returns the same error as
for an unknown order.
- createShoppingList and updateShoppingList now reject a payment method or
shipping address that does not belong to the party of the shopping list, and
the auto-reorder job skips lists that fail the same check.
---
applications/order/config/OrderErrorUiLabels.xml | 3 ++
.../shoppinglist/ShoppingListServicesScript.groovy | 8 ++++
.../order/shoppinglist/ShoppingListServices.java | 45 ++++++++++++++++++++++
3 files changed, 56 insertions(+)
diff --git a/applications/order/config/OrderErrorUiLabels.xml
b/applications/order/config/OrderErrorUiLabels.xml
index 3a68e4af8a..74e898d90f 100644
--- a/applications/order/config/OrderErrorUiLabels.xml
+++ b/applications/order/config/OrderErrorUiLabels.xml
@@ -4608,6 +4608,9 @@
<value xml:lang="zh">设置货币错误： </value>
<value xml:lang="zh-TW">設置貨幣錯誤:</value>
</property>
+ <property key="OrderShoppingListPaymentMethodOrAddressNotOwned">
+ <value xml:lang="en">The payment method or the shipping address does
not belong to the party of the shopping list</value>
+ </property>
<property key="OrderStatusIdNotExist">
<value xml:lang="ar">دليل الحالة غير موجود</value>
<value xml:lang="de">Status Id ist nicht vorhanden</value>
diff --git
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
index 58c61a3976..bf1b3c9961 100644
---
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
+++
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
@@ -32,6 +32,10 @@ Map createShoppingList() {
newEntity.partyId = newEntity.partyId ?: userLogin.partyId
newEntity.shoppingListTypeId = newEntity.shoppingListTypeId ?:
'SLT_WISH_LIST'
newEntity.isPublic = newEntity.isPublic ?: 'N'
+ if ((parameters.paymentMethodId || parameters.contactMechId)
+ && !ShoppingListServices.hasOwnPaymentMethodAndAddress(delegator,
newEntity)) {
+ return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderShoppingListPaymentMethodOrAddressNotOwned', parameters.locale))
+ }
newEntity.listName = newEntity.listName ?:
UtilProperties.getMessage('OrderUiLabels',
'OrderNewShoppingList', parameters.locale) ?: 'New Shopping List'
@@ -53,6 +57,10 @@ Map createShoppingList() {
Map updateShoppingList() {
GenericValue shoppingList =
from('ShoppingList').where(parameters).queryOne()
shoppingList.setNonPKFields(parameters)
+ if ((parameters.paymentMethodId || parameters.contactMechId)
+ && !ShoppingListServices.hasOwnPaymentMethodAndAddress(delegator,
shoppingList)) {
+ return error(UtilProperties.getMessage('OrderErrorUiLabels',
'OrderShoppingListPaymentMethodOrAddressNotOwned', parameters.locale))
+ }
// don't let auto-reorders be active unless there is some recurrence info
if (shoppingList.shoppingListTypeId == 'SLT_AUTO_REODR' &&
diff --git
a/applications/order/src/main/java/org/apache/ofbiz/order/shoppinglist/ShoppingListServices.java
b/applications/order/src/main/java/org/apache/ofbiz/order/shoppinglist/ShoppingListServices.java
index bfc9084297..37a6976c94 100644
---
a/applications/order/src/main/java/org/apache/ofbiz/order/shoppinglist/ShoppingListServices.java
+++
b/applications/order/src/main/java/org/apache/ofbiz/order/shoppinglist/ShoppingListServices.java
@@ -52,6 +52,7 @@ import org.apache.ofbiz.product.config.ProductConfigWorker;
import org.apache.ofbiz.product.config.ProductConfigWrapper;
import org.apache.ofbiz.product.product.ProductWorker;
import org.apache.ofbiz.product.store.ProductStoreWorker;
+import org.apache.ofbiz.security.Security;
import org.apache.ofbiz.service.DispatchContext;
import org.apache.ofbiz.service.GenericServiceException;
import org.apache.ofbiz.service.LocalDispatcher;
@@ -168,6 +169,12 @@ public class ShoppingListServices {
continue;
}
+ if (!hasOwnPaymentMethodAndAddress(delegator,
shoppingList)) {
+ Debug.logError("Payment method or shipping address of
shopping list " + shoppingList.getString("shoppingListId")
+ + " does not belong to party " +
shoppingList.getString("partyId") + ", no order created", MODULE);
+ continue;
+ }
+
ShoppingCart listCart = makeShoppingListCart(dispatcher,
shoppingList, locale);
CheckOutHelper helper = new CheckOutHelper(dispatcher,
delegator, listCart);
@@ -230,6 +237,33 @@ public class ShoppingListServices {
}
}
+ /**
+ * Checks that the payment method and the shipping address of a shopping
list, when set, belong to the party of the list
+ * @param delegator the delegator
+ * @param shoppingList the shopping list
+ * @return true if both are empty or belong to the party of the shopping
list
+ * @throws GenericEntityException if the payment method or the party
contact mech could not be read
+ */
+ public static boolean hasOwnPaymentMethodAndAddress(Delegator delegator,
GenericValue shoppingList) throws GenericEntityException {
+ String partyId = shoppingList.getString("partyId");
+ String paymentMethodId = shoppingList.getString("paymentMethodId");
+ if (UtilValidate.isNotEmpty(paymentMethodId)) {
+ GenericValue paymentMethod =
EntityQuery.use(delegator).from("PaymentMethod").where("paymentMethodId",
paymentMethodId).queryOne();
+ if (paymentMethod == null || partyId == null ||
!partyId.equals(paymentMethod.getString("partyId"))) {
+ return false;
+ }
+ }
+ String contactMechId = shoppingList.getString("contactMechId");
+ if (UtilValidate.isNotEmpty(contactMechId)) {
+ GenericValue partyContactMech =
EntityQuery.use(delegator).from("PartyContactMech")
+ .where("partyId", partyId, "contactMechId",
contactMechId).filterByDate().queryFirst();
+ if (partyContactMech == null) {
+ return false;
+ }
+ }
+ return true;
+ }
+
public static Map<String, Object>
splitShipmentMethodString(DispatchContext dctx, Map<String, ? extends Object>
context) {
String shipmentMethodString = (String)
context.get("shippingMethodString");
Map<String, Object> result = ServiceUtil.returnSuccess();
@@ -252,6 +286,7 @@ public class ShoppingListServices {
public static Map<String, Object> makeListFromOrder(DispatchContext dctx,
Map<String, ? extends Object> context) {
LocalDispatcher dispatcher = dctx.getDispatcher();
Delegator delegator = dctx.getDelegator();
+ Security security = dctx.getSecurity();
String shoppingListTypeId = (String) context.get("shoppingListTypeId");
String shoppingListId = (String) context.get("shoppingListId");
@@ -277,6 +312,16 @@ public class ShoppingListServices {
return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
"OrderUnableToLocateOrder", UtilMisc.toMap("orderId", orderId),
locale));
}
+ // only an order manager or the customer who placed the order can
make a shopping list from it
+ if (!security.hasEntityPermission("ORDERMGR", "_VIEW", userLogin))
{
+ GenericValue placingCustomer =
EntityQuery.use(delegator).from("OrderRole")
+ .where("orderId", orderId, "partyId",
userLogin.getString("partyId"), "roleTypeId", "PLACING_CUSTOMER")
+ .queryFirst();
+ if (placingCustomer == null) {
+ return
ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
"OrderUnableToLocateOrder", UtilMisc.toMap("orderId",
+ orderId), locale));
+ }
+ }
String productStoreId = orderHeader.getString("productStoreId");
if (UtilValidate.isEmpty(shoppingListId)) {
