[
https://issues.apache.org/jira/browse/OFBIZ-6207?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14379076#comment-14379076
]
Forrest Rae commented on OFBIZ-6207:
------------------------------------
Although, when applied to the 13.07 branch, it seems to cause an error.
Strange because it works great applied to Trunk.
[java] 2015-03-24 18:06:22,012 |-0.0.0.0-8443-exec-3 |PrimaryKeyFinder
|E| Error finding entity value by primary key with entity-one:
org.ofbiz.entity.GenericModelException: [GenericDelegator.findOne] Passed
primary key is not a valid primary key:
[GenericEntity:CustRequest][custRequestId,9000(java.lang.String)][fromPartyId,DemoCustomer(java.lang.String)]
[java] org.ofbiz.entity.GenericModelException: [GenericDelegator.findOne]
Passed primary key is not a valid primary key:
[GenericEntity:CustRequest][custRequestId,9000(java.lang.String)][fromPartyId,DemoCustomer(java.lang.String)]
[java] at
org.ofbiz.entity.GenericDelegator.findOne(GenericDelegator.java:1483)
~[ofbiz-entity.jar:?]
[java] at
org.ofbiz.entity.finder.PrimaryKeyFinder.runFind(PrimaryKeyFinder.java:154)
[ofbiz-entity.jar:?]
[java] at
org.ofbiz.entity.finder.PrimaryKeyFinder.runFind(PrimaryKeyFinder.java:86)
[ofbiz-entity.jar:?]
[java] at
org.ofbiz.widget.ModelWidgetAction$EntityOne.runAction(ModelWidgetAction.java:511)
[ofbiz-widget.jar:?]
[java] at
org.ofbiz.widget.ModelWidgetAction.runSubActions(ModelWidgetAction.java:114)
[ofbiz-widget.jar:?]
[java] at
org.ofbiz.widget.screen.ModelScreenWidget$Section.renderWidgetString(ModelScreenWidget.java:186)
[ofbiz-widget.jar:?]
[java] at
org.ofbiz.widget.screen.ModelScreen.renderScreenString(ModelScreen.java:396)
[ofbiz-widget.jar:?]
[java] at
org.ofbiz.widget.screen.ScreenRenderer.render(ScreenRenderer.java:135)
[ofbiz-widget.jar:?]
[java] at
org.ofbiz.widget.screen.ScreenRenderer.render(ScreenRenderer.java:97)
[ofbiz-widget.jar:?]
[java] at
org.ofbiz.widget.screen.MacroScreenViewHandler.render(MacroScreenViewHandler.java:104)
[ofbiz-widget.jar:?]
[java] at
org.ofbiz.webapp.control.RequestHandler.renderView(RequestHandler.java:916)
[ofbiz-webapp.jar:?]
[java] at
org.ofbiz.webapp.control.RequestHandler.doRequest(RequestHandler.java:614)
[ofbiz-webapp.jar:?]
[java] at
org.ofbiz.webapp.control.ControlServlet.doGet(ControlServlet.java:218)
[ofbiz-webapp.jar:?]
> Anyone can view any Request or Quote
> ------------------------------------
>
> Key: OFBIZ-6207
> URL: https://issues.apache.org/jira/browse/OFBIZ-6207
> Project: OFBiz
> Issue Type: Bug
> Components: specialpurpose/ecommerce
> Affects Versions: Trunk, 13.07.01
> Reporter: Forrest Rae
> Priority: Critical
> Labels: security
> Attachments: OFBIZ-6207-second-attempt.patch, OFBIZ-6207.patch
>
>
> This is a security bug in the ecommerce application. Anyone can view any
> quote or request in the system regardless of the associated partyId. They
> can do this via URL parameter manipulation.
> Reproduction:
> 1) Login to the ecommerce application as DemoCustomer.
> 2) Navigate to
> http://demo-stable-ofbiz.apache.org/ecommerce/control/ViewRequest?custRequestId=9000
> to view your own request.
> 3) Navigate to
> http://demo-stable-ofbiz.apache.org/ecommerce/control/ViewRequest?custRequestId=9001
> to view DemoCustAgent's request.
> 4) Navigate to
> http://demo-stable-ofbiz.apache.org/ecommerce/control/ViewRequest?custRequestId=9002
> to view DemoCustomer2's request.
> Same goes for Quotes, although there are no quotes in the Demo data. The
> attach patch fixes this issue.
> Would like this issue back ported to release 13.07 please.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
