[jira] [Closed] (OFBIZ-13671) Payment method update services don't verify the caller-supplied paymentMethodId belongs to the authorized party before writing to it

["Mridul Pathak (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-13671?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mridul Pathak closed OFBIZ-13671.
---------------------------------
    Fix Version/s: Upcoming Branch
                   24.09.08
       Resolution: Fixed

> Payment method update services don't verify the caller-supplied paymentMethodId belongs to the authorized party before writing to it
> ------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13671
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13671
>             Project: OFBiz
>          Issue Type: Bug
>          Components: accounting
>    Affects Versions: Upcoming Branch, 24.09.07
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>             Fix For: Upcoming Branch, 24.09.08
>
>
> {{createEftAccount}}, {{createGiftCard}}, and {{createCreditCard}} ({{PaymentMethodServices.java}}) check that the caller owns the target {{partyId}}, but accept an optional caller-supplied {{paymentMethodId}} without checking it belongs to that party before writing to it. Same issue in the group services {{createEftAccountAndAddress}} / {{createCreditCardAndAddress}}.
> h3. Suggested fix
> Verify an existing {{paymentMethodId}} already belongs to the authorized party before writing to it; reject otherwise.
> h3. Acceptance criteria
> * A supplied {{paymentMethodId}} belonging to a different party is rejected.
> * Creating a new payment method (no existing id) is unaffected.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)