[PR] Fixed: OFBizApplicationSecurity.hasRolePermission no longer treats an empty roles list as unrestricted access (OFBIZ-13495) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak opened a new pull request, #1673:
URL: https://github.com/apache/ofbiz-framework/pull/1673

   An empty (but non-null) roles list passed to OFBizApplicationSecurity.hasRolePermission caused EntityCondition to silently drop the empty OR-of-roleTypeId sub-condition instead of evaluating it as always-false, so a user holding only the scoped "_ROLE" permission (e.g. ORDERMGR_ROLE) could pass role-based access checks for any role instead of none, and this change guards the SIMPLE_ROLE_ENT condition-building with roles.isEmpty() so an empty list correctly denies role-based access while leaving the standard entity-permission fallback unaffected, closing a latent gap in the live production Security implementation even though no caller in the current codebase passes an empty roles list today.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fixed: OFBizApplicationSecurity.hasRolePermission no longer treats an empty roles list as unrestricted access (OFBIZ-13495) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak merged PR #1673:
URL: https://github.com/apache/ofbiz-framework/pull/1673


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org