You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by as...@apache.org on 2026/08/26 11:54:08 UTC
(ofbiz-framework) branch trunk updated: Improved: Anchor catalog quick-admin write events to their permission tier (#1739)
This is an automated email from the ASF dual-hosted git repository.
ashishvijaywargiya pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 98d624f9cf Improved: Anchor catalog quick-admin write events to their permission tier (#1739)
98d624f9cf is described below
commit 98d624f9cf1fb2fd6de78833c23ff4814cd74139
Author: Krishna Uprit <kr...@gmail.com>
AuthorDate: Wed Aug 26 17:24:03 2026 +0530
Improved: Anchor catalog quick-admin write events to their permission tier (#1739)
- updateProductQuickAdminShipping, updateProductQuickAdminSelFeat,
removeFeatureApplsByFeatureTypeId, removeProductFeatureAppl,
addProductToCategories, updateProductCategoryMember, and
addProductFeatures now call the same entity-permission check already
used by their sibling methods updateAllKeywords and updateProductAssoc
in this same file, before running.
- Added a small shared helper, checkCatalogPermission, so the check is
consistent across all seven methods instead of being repeated inline.
Thank you Krishna Uprit for the contribution.
Co-authored-by: Krishnauprit18 <kr...@users.noreply.github.com>
---
.../ofbiz/product/product/ProductEvents.java | 44 ++++++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git a/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java b/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java
index c100986811..f170ef0f03 100644
--- a/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java
+++ b/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java
@@ -431,7 +431,21 @@ public class ProductEvents {
return "success";
}
+ private static String checkCatalogPermission(HttpServletRequest request, String updateMode) {
+ Security security = (Security) request.getAttribute("security");
+ if (!security.hasEntityPermission("CATALOG", "_" + updateMode, request.getSession())) {
+ Map<String, String> messageMap = UtilMisc.toMap("updateMode", updateMode);
+ return UtilProperties.getMessage(RESOURCE, "productevents.not_sufficient_permissions", messageMap, UtilHttp.getLocale(request));
+ }
+ return null;
+ }
+
public static String updateProductQuickAdminShipping(HttpServletRequest request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "UPDATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
Timestamp nowTimestamp = UtilDateTime.nowTimestamp();
GenericValue userLogin = (GenericValue) request.getSession().getAttribute("userLogin");
@@ -606,6 +620,11 @@ public class ProductEvents {
}
public static String updateProductQuickAdminSelFeat(HttpServletRequest request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "UPDATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
Timestamp nowTimestamp = UtilDateTime.nowTimestamp();
String productId = request.getParameter("productId");
@@ -788,6 +807,11 @@ public class ProductEvents {
}
public static String removeFeatureApplsByFeatureTypeId(HttpServletRequest request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "DELETE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productFeatureTypeId = request.getParameter("productFeatureTypeId");
@@ -825,6 +849,11 @@ public class ProductEvents {
}
public static String removeProductFeatureAppl(HttpServletRequest request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "DELETE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productFeatureId = request.getParameter("productFeatureId");
@@ -847,6 +876,11 @@ public class ProductEvents {
}
public static String addProductToCategories(HttpServletRequest request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "CREATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String fromDateStr = request.getParameter("fromDate");
@@ -876,6 +910,11 @@ public class ProductEvents {
}
public static String updateProductCategoryMember(HttpServletRequest request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "UPDATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productCategoryId = request.getParameter("productCategoryId");
@@ -902,6 +941,11 @@ public class ProductEvents {
}
public static String addProductFeatures(HttpServletRequest request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "CREATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productFeatureApplTypeId = request.getParameter("productFeatureApplTypeId");