You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by ja...@apache.org on 2026/06/04 08:42:29 UTC
(ofbiz-framework) branch release24.09 updated (4cad9a2907 -> a826b1a759)
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a change to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from 4cad9a2907 Bump dompurify in /themes/common-theme/webapp/common-theme/js
new 138175efcb Add unrestricted security permissions for Content Manager operations
new 0d9a551daa Implement special permission handling for DataResource CRUD operations when the dataTemplateTypeId attribute is set
new a826b1a759 Refactor DataResource permission handling to use genericBasePermissionCheck service instead of the deprecated Minilang method
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../permission/DataResourcePermissionServices.xml | 21 +++++++++++++++++++++
applications/content/servicedef/services.xml | 1 +
.../datamodel/data/demo/ContentDemoData.xml | 7 +++++++
.../datamodel/data/seed/ContentSeedData.xml | 6 ++++++
4 files changed, 35 insertions(+)
(ofbiz-framework) 02/03: Implement special permission handling for DataResource CRUD operations when the dataTemplateTypeId attribute is set
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 0d9a551daa374ef287b1e745161d4d036299870c
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Tue Jun 2 19:30:54 2026 +0200
Implement special permission handling for DataResource CRUD operations when the dataTemplateTypeId attribute is set
(cherry picked from commit 40c0aa133c103f391523d124f29dce3f484eab8a)
---
.../permission/DataResourcePermissionServices.xml | 18 ++++++++++++++++++
applications/content/servicedef/services.xml | 1 +
2 files changed, 19 insertions(+)
diff --git a/applications/content/minilang/permission/DataResourcePermissionServices.xml b/applications/content/minilang/permission/DataResourcePermissionServices.xml
index 3ef085d961..66140191e1 100644
--- a/applications/content/minilang/permission/DataResourcePermissionServices.xml
+++ b/applications/content/minilang/permission/DataResourcePermissionServices.xml
@@ -21,6 +21,24 @@
xmlns="http://ofbiz.apache.org/Simple-Method" xsi:schemaLocation="http://ofbiz.apache.org/Simple-Method http://ofbiz.apache.org/dtds/simple-methods.xsd">
<simple-method method-name="genericDataResourcePermission" short-description="Generic Service for DataResource Permissions">
+ <!-- Operating with DataResources containing templates requires special permission -->
+ <if>
+ <condition>
+ <and>
+ <not>
+ <if-empty field="parameters.dataTemplateTypeId"/>
+ </not>
+ <if-compare field="parameters.dataTemplateTypeId" value="NONE" operator="not-equals"/>
+ </and>
+ </condition>
+ <then>
+ <set field="primaryPermission" value="CONTENTMGR_SUPER"/>
+ <call-simple-method method-name="genericBasePermissionCheck"
+ xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
+ <return/>
+ </then>
+ </if>
+
<set field="primaryPermission" value="CONTENTMGR"/>
<call-simple-method method-name="genericBasePermissionCheck" xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
diff --git a/applications/content/servicedef/services.xml b/applications/content/servicedef/services.xml
index 24fb5c2197..4330262773 100644
--- a/applications/content/servicedef/services.xml
+++ b/applications/content/servicedef/services.xml
@@ -898,6 +898,7 @@
<description>Generic DataResource Permission Service; Takes mainAction to determine the mode.</description>
<implements service="permissionInterface"/>
<attribute name="dataResourceId" type="String" mode="IN" optional="true"/>
+ <attribute name="dataTemplateTypeId" type="String" mode="IN" optional="true"/>
</service>
<service name="createContentAlternativeUrl" engine="groovy"
(ofbiz-framework) 01/03: Add unrestricted security permissions for Content Manager operations
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 138175efcb7d02521f63543516a148abb31d7619
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Tue Jun 2 19:27:54 2026 +0200
Add unrestricted security permissions for Content Manager operations
These permissions should only be granted to trusted administrative users, as they may be harmful.
(cherry picked from commit a8b56aad89504a5a3e5338c5a4f32e362e639260)
---
applications/datamodel/data/demo/ContentDemoData.xml | 7 +++++++
applications/datamodel/data/seed/ContentSeedData.xml | 6 ++++++
2 files changed, 13 insertions(+)
diff --git a/applications/datamodel/data/demo/ContentDemoData.xml b/applications/datamodel/data/demo/ContentDemoData.xml
index bb74fc07e8..db80767004 100644
--- a/applications/datamodel/data/demo/ContentDemoData.xml
+++ b/applications/datamodel/data/demo/ContentDemoData.xml
@@ -19,6 +19,13 @@ under the License.
-->
<entity-engine-xml>
<!-- Content Manager security -->
+ <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FULLADMIN" permissionId="CONTENTMGR_SUPER_ADMIN"/>
+ <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_CREATE"/>
+ <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_DELETE"/>
+ <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_UPDATE"/>
+ <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_VIEW"/>
+ <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="VIEWADMIN" permissionId="CONTENTMGR_SUPER_VIEW"/>
+
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FULLADMIN" permissionId="CONTENTMGR_ADMIN"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_CREATE"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_DELETE"/>
diff --git a/applications/datamodel/data/seed/ContentSeedData.xml b/applications/datamodel/data/seed/ContentSeedData.xml
index ef329b14c1..793092fdb9 100644
--- a/applications/datamodel/data/seed/ContentSeedData.xml
+++ b/applications/datamodel/data/seed/ContentSeedData.xml
@@ -2093,6 +2093,11 @@ ${txt}
<DataResource dataResourceId="HELP_TEMPL" dataResourceTypeId="OFBIZ_FILE" objectInfo="applications/content/template/HelpTemplate.ftl" dataTemplateTypeId="FTL" statusId="CTNT_IN_PROGRESS" dataResourceName="Help template file" mimeTypeId="text/html" isPublic="Y"/>
<!-- Content Manager security -->
+ <SecurityPermission description="View operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_VIEW"/>
+ <SecurityPermission description="Create operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_CREATE"/>
+ <SecurityPermission description="Update operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_UPDATE"/>
+ <SecurityPermission description="Delete operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_DELETE"/>
+ <SecurityPermission description="ALL operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_ADMIN"/>
<SecurityPermission description="View operations in the Content Manager." permissionId="CONTENTMGR_VIEW"/>
<SecurityPermission description="Create operations in the Content Manager." permissionId="CONTENTMGR_CREATE"/>
<SecurityPermission description="Update operations in the Content Manager." permissionId="CONTENTMGR_UPDATE"/>
@@ -2106,6 +2111,7 @@ ${txt}
<SecurityPermission description="Limited Delete operations in the Content Manager." permissionId="CONTENTMGR_ROLE_DELETE"/>
<!-- add admin to SUPER permission group -->
+ <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPER" permissionId="CONTENTMGR_SUPER_ADMIN"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPER" permissionId="CONTENTMGR_ADMIN"/>
<DataResource dataResourceId="NOCONTENTFOUND" dataResourceTypeId="OFBIZ_FILE" dataTemplateTypeId="NONE" objectInfo="/applications/content/webapp/content/images/nocontentfound.png"
(ofbiz-framework) 03/03: Refactor DataResource permission handling to use genericBasePermissionCheck service instead of the deprecated Minilang method
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit a826b1a759310b2a5d556a3cc6a9f42aeda9d162
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Tue Jun 2 20:39:32 2026 +0200
Refactor DataResource permission handling to use genericBasePermissionCheck service instead of the deprecated Minilang method
(cherry picked from commit 4761d0bea5fc7ab5acb06350e00e85e8e73f10c1)
---
.../minilang/permission/DataResourcePermissionServices.xml | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/applications/content/minilang/permission/DataResourcePermissionServices.xml b/applications/content/minilang/permission/DataResourcePermissionServices.xml
index 66140191e1..b1d9954410 100644
--- a/applications/content/minilang/permission/DataResourcePermissionServices.xml
+++ b/applications/content/minilang/permission/DataResourcePermissionServices.xml
@@ -32,9 +32,12 @@
</and>
</condition>
<then>
- <set field="primaryPermission" value="CONTENTMGR_SUPER"/>
- <call-simple-method method-name="genericBasePermissionCheck"
- xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
+ <set field="inParams.primaryPermission" value="CONTENTMGR_SUPER"/>
+ <set field="inParams.mainAction" from-field="parameters.mainAction"/>
+ <call-service service-name="genericBasePermissionCheck" in-map-name="inParams">
+ <result-to-field result-name="hasPermission"/>
+ </call-service>
+ <field-to-result field="hasPermission"/>
<return/>
</then>
</if>