You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by ja...@apache.org on 2026/05/10 08:43:14 UTC
(ofbiz-framework) branch release24.09 updated (4ed7011a24 -> e456b65f89)
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a change to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from 4ed7011a24 Ofbiz 13374 Fixed: incorrect Groovy range iteration that was causing index out of bounds (#1177)
new 3aeb79c7ca Fixed: Update permission checks in CommonScreens.xml for webtools access
new 66f334d5e8 Fixed: Add sun.util.calendar.ZoneInfo to allowList in SafeObjectInputStream configuration
new e456b65f89 Fixed: Add permission checks for SERVICE_MAINT in CoreEvents to enhance security
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
framework/base/config/SafeObjectInputStream.properties | 2 +-
.../org/apache/ofbiz/base/util/SafeObjectInputStream.java | 3 ++-
.../java/org/apache/ofbiz/webapp/event/CoreEvents.java | 15 ++++++++++++++-
framework/webtools/widget/CommonScreens.xml | 9 ++++-----
4 files changed, 21 insertions(+), 8 deletions(-)
(ofbiz-framework) 02/03: Fixed: Add sun.util.calendar.ZoneInfo to allowList in SafeObjectInputStream configuration
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 66f334d5e88251135d546b04b2d0ee632a066645
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Sun May 10 09:30:45 2026 +0200
Fixed: Add sun.util.calendar.ZoneInfo to allowList in SafeObjectInputStream configuration
(cherry picked from commit 1a012021eacc1adb8618ec2c809f758c1ac1ab74)
---
framework/base/config/SafeObjectInputStream.properties | 2 +-
.../main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/framework/base/config/SafeObjectInputStream.properties b/framework/base/config/SafeObjectInputStream.properties
index 3e6fda2e74..7f759b66f5 100644
--- a/framework/base/config/SafeObjectInputStream.properties
+++ b/framework/base/config/SafeObjectInputStream.properties
@@ -27,7 +27,7 @@
# . don't forget to add new objects in SafeObjectInputStream class too (as default there).
# . "foo" and "SerializationInjector" are used in OFBiz tests
-allowList=byte\\[\\], foo, SerializationInjector, \\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java..*, org.apache.ofbiz..*, org.codehaus.groovy.runtime.GStringImpl, groovy.lang.GString
+allowList=byte\\[\\], foo, SerializationInjector, \\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java..*, org.apache.ofbiz..*, org.codehaus.groovy.runtime.GStringImpl, groovy.lang.GString, sun.util.calendar.ZoneInfo
#-- List of strings rejected for serialisation
#-- The same comments than for allowList apply to denyList
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
index aedea1a082..9fe35b58f9 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
@@ -68,7 +68,8 @@ public final class SafeObjectInputStream extends ObjectInputStream {
"org\\.apache\\.ofbiz\\.entity\\.GenericValue",
"org\\.apache\\.ofbiz\\.entity\\.GenericPK",
"org\\.codehaus\\.groovy\\.runtime\\.GStringImpl",
- "groovy\\.lang\\.GString"};
+ "groovy\\.lang\\.GString",
+ "sun\\.util\\.calendar\\.ZoneInfo"};
private static final String[] DEFAULT_DENYLIST = {"rmi", "<"};
/** The regular expression used to match serialized types. */
(ofbiz-framework) 01/03: Fixed: Update permission checks in CommonScreens.xml for webtools access
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 3aeb79c7caa72f9b046963ae652e7a27af0ea966
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Sun May 10 09:28:02 2026 +0200
Fixed: Update permission checks in CommonScreens.xml for webtools access
(cherry picked from commit c09ee1cdad7ad19532919722a7ab897788a49edf)
---
framework/webtools/widget/CommonScreens.xml | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/framework/webtools/widget/CommonScreens.xml b/framework/webtools/widget/CommonScreens.xml
index 17dd97b31d..c9c4952666 100644
--- a/framework/webtools/widget/CommonScreens.xml
+++ b/framework/webtools/widget/CommonScreens.xml
@@ -153,7 +153,7 @@ under the License.
<decorator-section name="pre-body">
<section>
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="SERVICE_MAINT"/>
</condition>
<widgets>
<include-menu name="ServiceTabBar" location="component://webtools/widget/Menus.xml"/>
@@ -164,7 +164,7 @@ under the License.
<section>
<!-- do check for WEBTOOLS, _VIEW permission -->
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="SERVICE_MAINT"/>
</condition>
<widgets>
<decorator-section-include name="body"/>
@@ -297,7 +297,7 @@ under the License.
<decorator-section name="pre-body">
<section>
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="PORTALPAGE_ADMIN"/>
</condition>
<widgets>
<include-menu name="GeoManagement" location="component://webtools/widget/Menus.xml"/>
@@ -306,9 +306,8 @@ under the License.
</decorator-section>
<decorator-section name="body">
<section>
- <!-- do check for WEBTOOLS, _VIEW permission -->
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="PORTALPAGE_ADMIN"/>
</condition>
<widgets>
<decorator-section-include name="body"/>
(ofbiz-framework) 03/03: Fixed: Add permission checks for SERVICE_MAINT in CoreEvents to enhance security
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit e456b65f894ff58b0ea2a9415308fd77e280aaff
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Sun May 10 09:57:52 2026 +0200
Fixed: Add permission checks for SERVICE_MAINT in CoreEvents to enhance security
(cherry picked from commit f05a0c2268f163573a0e0895ec381593de1283db)
---
.../java/org/apache/ofbiz/webapp/event/CoreEvents.java | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
index dabc221d8d..aab160ba77 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
@@ -113,6 +113,12 @@ public class CoreEvents {
Locale locale = UtilHttp.getLocale(request);
TimeZone timeZone = UtilHttp.getTimeZone(request);
+ if (!security.hasPermission("SERVICE_MAINT", userLogin)) {
+ String errMsg = UtilProperties.getMessage(ERR_RESOURCE, "coreEvents.not_authorized_to_call", locale);
+ request.setAttribute("_ERROR_MESSAGE_", errMsg);
+ return "error";
+ }
+
Map<String, Object> params = UtilHttp.getParameterMap(request);
// get the schedule parameters
String jobName = (String) params.remove("JOB_NAME");
@@ -434,11 +440,19 @@ public class CoreEvents {
* @return Response code string
*/
public static String runService(HttpServletRequest request, HttpServletResponse response) {
+ Security security = (Security) request.getAttribute("security");
+ GenericValue userLogin = (GenericValue) request.getSession().getAttribute("userLogin");
// get the mode and service name
String serviceName = request.getParameter("serviceName");
String mode = request.getParameter("mode");
Locale locale = UtilHttp.getLocale(request);
+ if (!security.hasPermission("SERVICE_MAINT", userLogin)) {
+ String errMsg = UtilProperties.getMessage(ERR_RESOURCE, "coreEvents.not_authorized_to_call", locale);
+ request.setAttribute("_ERROR_MESSAGE_", errMsg);
+ return "error";
+ }
+
if (UtilValidate.isEmpty(serviceName)) {
String errMsg = UtilProperties.getMessage(ERR_RESOURCE, "coreEvents.must_specify_service_name", locale);
request.setAttribute("_ERROR_MESSAGE_", errMsg);
@@ -450,7 +464,6 @@ public class CoreEvents {
}
// now do a security check
- Security security = (Security) request.getAttribute("security");
LocalDispatcher dispatcher = (LocalDispatcher) request.getAttribute("dispatcher");
//lookup the service definition to see if this service is externally available, if not require the SERVICE_INVOKE_ANY permission