This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 7099f47083 Fixed: Shopping list permission services check the wrong
permission action (OFBIZ-13702)
7099f47083 is described below
commit 7099f47083c8a26b0e6e5e9cd5ca80b81766a854
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Oct 21 17:18:30 2026 +0530
Fixed: Shopping list permission services check the wrong permission action
(OFBIZ-13702)
- checkShoppingListSecurity and checkShoppingListItemSecurity built the
PARTYMGR permission from a permissionAction parameter that permissionInterface
does not define, so only PARTYMGR_ADMIN passed. They now use mainAction, and
fill the error message from resourceDescription and mainAction instead of
leaving the placeholders empty.
- calculateShoppingListDeepTotalPrice called checkShoppingListItemSecurity
without an action. It now checks with the VIEW action, as the original minilang
did.
---
.../shoppinglist/ShoppingListServicesScript.groovy | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
index bf1b3c9961..a8b755f4c8 100644
---
a/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
+++
b/applications/order/src/main/groovy/org/apache/ofbiz/order/shoppinglist/ShoppingListServicesScript.groovy
@@ -168,7 +168,8 @@ Map addDistinctShoppingListItem() {
*/
Map calculateShoppingListDeepTotalPrice() {
Map result = success()
- Map serviceResult = run service: 'checkShoppingListItemSecurity', with:
parameters
+ Map serviceResult = run service: 'checkShoppingListItemSecurity', with:
[*: parameters,
+ mainAction: 'VIEW', resourceDescription:
'calculateShoppingListDeepTotalPrice']
require(ServiceUtil.isSuccess(serviceResult) as boolean,
serviceResult.errorMessage)
require(serviceResult.hasPermission as boolean, 'OrderErrorUiLabels',
'OrderSecurityErrorToRunForAnotherParty')
Map calcPriceInBaseMap = [prodCatalogId: parameters.prodCatalogId,
webSiteId: parameters.webSiteId]
@@ -225,13 +226,15 @@ Map checkShoppingListSecurity() {
if (parameters.shoppingListId) {
GenericValue shoppingList = from('ShoppingList').where(shoppingListId:
parameters.shoppingListId).queryOne()
require(!shoppingList?.partyId || userLogin?.partyId ==
shoppingList.partyId
- || security.hasEntityPermission('PARTYMGR',
"_${parameters.permissionAction}", parameters.userLogin),
- 'OrderErrorUiLabels', 'OrderSecurityErrorToRunForAnotherParty')
+ || security.hasEntityPermission('PARTYMGR',
"_${parameters.mainAction}", parameters.userLogin),
+ 'OrderErrorUiLabels', 'OrderSecurityErrorToRunForAnotherParty',
+ [parentMethodName: parameters.resourceDescription,
permissionAction: parameters.mainAction])
}
require(!userLogin || (userLogin.userLoginId == 'anonymous') ||
!parameters.partyId || (userLogin.partyId == parameters.partyId)
- || security.hasEntityPermission('PARTYMGR',
"_${parameters.permissionAction}", parameters.userLogin),
- 'OrderErrorUiLabels', 'OrderSecurityErrorToRunForAnotherParty')
+ || security.hasEntityPermission('PARTYMGR',
"_${parameters.mainAction}", parameters.userLogin),
+ 'OrderErrorUiLabels', 'OrderSecurityErrorToRunForAnotherParty',
+ [parentMethodName: parameters.resourceDescription,
permissionAction: parameters.mainAction])
Map result = success()
result.hasPermission = true
@@ -244,11 +247,11 @@ Map checkShoppingListSecurity() {
Map checkShoppingListItemSecurity() {
GenericValue shoppingList =
from('ShoppingList').where(parameters).queryOne()
require(!shoppingList?.partyId || userLogin.partyId ==
shoppingList.partyId ||
- security.hasEntityPermission('PARTYMGR',
"_${parameters.permissionAction}", parameters.userLogin),
+ security.hasEntityPermission('PARTYMGR',
"_${parameters.mainAction}", parameters.userLogin),
'OrderErrorUiLabels',
'OrderSecurityErrorToRunForAnotherParty',
- [parentMethodName: parameters.parentMethodName,
- permissionAction: parameters.permissionAction])
+ [parentMethodName: parameters.resourceDescription,
+ permissionAction: parameters.mainAction])
Map result = success()
result.hasPermission = true
