You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by lf...@apache.org on 2026/10/08 06:41:32 UTC
(ofbiz-framework) branch trunk updated: Fixed: Hardens security by adding missing permission check in OrderServices (#2217)
This is an automated email from the ASF dual-hosted git repository.
Lukas-Finster pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new df3aa3c824 Fixed: Hardens security by adding missing permission check in OrderServices (#2217)
df3aa3c824 is described below
commit df3aa3c824fb43e560625d8a9d3a38ace7187c7a
Author: Lukas-Finster <lu...@ecomify.de>
AuthorDate: Thu Oct 8 08:41:27 2026 +0200
Fixed: Hardens security by adding missing permission check in OrderServices (#2217)
---
.../src/main/java/org/apache/ofbiz/order/order/OrderServices.java | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
index 2ce471b7d0..49dfed97dd 100644
--- a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
+++ b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
@@ -3881,6 +3881,13 @@ public class OrderServices {
GenericValue userLogin = (GenericValue) context.get("userLogin");
Locale locale = (Locale) context.get("locale");
String orderId = (String) context.get("orderId");
+ Security security = dctx.getSecurity();
+
+ if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE", security, delegator)) {
+ return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
+ "OrderYouDoNotHavePermissionToChangeThisOrdersStatus", locale));
+ }
+
Map<String, String> overridePriceMap = UtilGenerics.cast(context.get("overridePriceMap"));
Map<String, String> itemDescriptionMap = UtilGenerics.cast(context.get("itemDescriptionMap"));
Map<String, String> itemPriceMap = UtilGenerics.cast(context.get("itemPriceMap"));