[jira] [Commented] (OFBIZ-13715) Add missing permission checks to product costing, catalog and shipment-method services

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-13715?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132344#comment-18132344 ] 

ASF subversion and git services commented on OFBIZ-13715:
---------------------------------------------------------

Commit 4535e37a15140dc459c336d6ee3d4b38f1ed0fd9 in ofbiz-framework's branch refs/heads/trunk from Mridul Pathak
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=4535e37a15 ]

Fixed: Add missing permission checks to product costing, catalog and shipment-method services (OFBIZ-13715)

- CostComponent/ProductCostComponentCalc (create/update/delete), createProductPaymentMethodType, createProductGroupOrder, CarrierShipmentMethod (create/update), updateShipmentMethodType, removeShipmentEstimate and ShipmentTimeEstimate (update/expire) now require the existing productGenericPermission, matching the convention already used 38x elsewhere in services.xml.
- ProductStoreGroup (create/update) and createProductStoreGroupMember now require the existing productStoreGenericPermission, matching sibling store services.
- ProductPriceAction (create/update/delete) now require the existing productPriceGenericPermission, matching sibling createProductPriceRule/updateProductPriceRule.
- balanceInventoryItems and setOrderReservationPriority now require a new orderInventoryPermissionCheck, since no sibling in this order-management inventory-reservation cluster had any permission check to reuse.


> Add missing permission checks to product costing, catalog and shipment-method services
> --------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13715
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13715
>             Project: OFBiz
>          Issue Type: Bug
>          Components: product
>    Affects Versions: Upcoming Branch, 24.09.08
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> 22 product services mutate cost components, product store groups, price-rule actions, shipment-method configuration, and order inventory reservations without verifying the caller's permission: balanceInventoryItems, createCarrierShipmentMethod, createCostComponent, createProductCostComponentCalc, createProductGroupOrder, createProductPaymentMethodType, createProductPriceAction, createProductStoreGroup, createProductStoreGroupMember, deleteCostComponent, deleteProductCostComponentCalc, deleteProductPriceAction, expireShipmentTimeEstimate, removeShipmentEstimate, setOrderReservationPriority, updateCarrierShipmentMethod, updateCostComponent, updateProductCostComponentCalc, updateProductPriceAction, updateProductStoreGroup, updateShipmentMethodType, updateShipmentTimeEstimate. Most should require the same permission check already enforced on comparable sibling services in the same files; the two order-inventory services need a new check since no sibling in that area is protected either.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)