"security permission setting to view only orders created by person/group who created them."
I guess this is normal expectancy from the ecommnerce application. I am sure nobody wants their orders to be view by other users and get access to their personal info. I have not fully digged into, security permission, but basically i am using the default setup, with minor touches here and there. Rohit Walter Vaughan wrote: > > rohit2006 wrote: > >> I just noticed a potentially major security loophole in ofbiz. If you >> login >> to the ecommerce area of ofbiz and view an order using the URL >> https://www.example.com/ecommerce/control/orderstatus?orderId=10330, you >> can >> view any order made by other users by changing the order number in the >> URL >> for eg. > > Just so I understand the problem, what you are saying is that if you have > login > permissions to view orders, you want a security permission setting to view > only > orders created by person/group who created them. > > Is that what you are asking? > > IANAL, but it's more like you are wanting a security group that can only > see > orders created by the same party_id as the current login party_id. Is that > correct? > > What security group are you currently using to view these orders? > > -- > Walter > > > > > -- View this message in context: http://www.nabble.com/Major-security-lapse-in-ofbiz.-Changing-order---in-URL-allows-other-orders-to-be-viewed...-tf3143749.html#a8723123 Sent from the OFBiz - User mailing list archive at Nabble.com.
