[jira] [Created] (OFBIZ-13715) Add missing permission checks to product costing, catalog and shipment-method services

["Mridul Pathak (Jira)" <ji...@apache.org>]

Mridul Pathak created OFBIZ-13715:
-------------------------------------

             Summary: Add missing permission checks to product costing, catalog and shipment-method services
                 Key: OFBIZ-13715
                 URL: https://issues.apache.org/jira/browse/OFBIZ-13715
             Project: OFBiz
          Issue Type: Bug
          Components: product
    Affects Versions: Upcoming Branch, 24.09.08
            Reporter: Mridul Pathak
            Assignee: Mridul Pathak


22 product services mutate cost components, product store groups, price-rule actions, shipment-method configuration, and order inventory reservations without verifying the caller's permission: balanceInventoryItems, createCarrierShipmentMethod, createCostComponent, createProductCostComponentCalc, createProductGroupOrder, createProductPaymentMethodType, createProductPriceAction, createProductStoreGroup, createProductStoreGroupMember, deleteCostComponent, deleteProductCostComponentCalc, deleteProductPriceAction, expireShipmentTimeEstimate, removeShipmentEstimate, setOrderReservationPriority, updateCarrierShipmentMethod, updateCostComponent, updateProductCostComponentCalc, updateProductPriceAction, updateProductStoreGroup, updateShipmentMethodType, updateShipmentTimeEstimate. Most should require the same permission check already enforced on comparable sibling services in the same files; the two order-inventory services need a new check since no sibling in that area is protected either.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)