[jira] [Assigned] (OFBIZ-6605) createQuoteRole, createContentRole, and createRequirementRole allow for adding Roles to a Party without permissions

["Jacques Le Roux (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-6605?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jacques Le Roux reassigned OFBIZ-6605:
--------------------------------------

    Assignee: Jacques Le Roux

> createQuoteRole, createContentRole, and createRequirementRole allow for adding Roles to a Party without permissions
> -------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-6605
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-6605
>             Project: OFBiz
>          Issue Type: Bug
>          Components: content, order
>    Affects Versions: Release Branch 11.04, Release Branch 13.07, Release Branch 14.12, Trunk
>            Reporter: Forrest Rae
>            Assignee: Jacques Le Roux
>              Labels: security
>
> The following functions automatically add a PartyRole entry if the PartyRole does not exist.  This is possible even when the userLogin doesn't have PARTYMGR_UPDATE or PARTYMGR_CREATE.
> createQuoteRole
> createContentRole
> createRequirementRole
> Repo:
> 1) Remove PARTYMGR_UPDATE or PARTYMGR_CREATE permissions from the ORDERENTRY group.
> 2) Login as DemoRepStore
> 3) Create a Quote
> 4) Add a QuoteRole with partyId of DemoRepStore and Role of your choosing.
> 5) View DemoRepStore roles.
> This is a security problem for anyone building component that leverages Role based security.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)