You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@ofbiz.apache.org by GitBox <gi...@apache.org> on 2026/10/13 08:34:19 UTC

[GH] (ofbiz-framework/release24.09.08): Workflow run "Build and push docker images" is working again!

The GitHub Actions job "Build and push docker images" on ofbiz-framework.git/release24.09.08 has succeeded.
Run started by GitHub user nmalin (triggered by nmalin).

Head commit for run:
c1ee49f826eba560fe9fa80a81f851ad36c5a583 / Mridul Pathak <mr...@gmail.com>
Fixed: createReturnItem() does not verify OrderItem ownership before attaching it to a ReturnHeader

createReturnItem() authorizes the request against the supplied ReturnHeader (ORDERMGR_CREATE or ReturnHeader.fromPartyId == userLogin.partyId), but then resolves the OrderItem from caller-supplied orderId/orderItemSeqId without checking that it belongs to an order associated with ReturnHeader.fromPartyId. This let a non-privileged caller attach an OrderItem from an unrelated order to a ReturnHeader they control. For callers without ORDERMGR_CREATE, this now requires an OrderRole linking ReturnHeader.fromPartyId to the resolved OrderItem's order before accepting it.

Report URL: https://github.com/apache/ofbiz-framework/actions/runs/38363924068

With regards,
GitHub Actions via GitBox