[jira] [Closed] (OFBIZ-13672) updateContactList service does not enforce marketing UPDATE permission

["Mridul Pathak (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-13672?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mridul Pathak closed OFBIZ-13672.
---------------------------------
    Fix Version/s: Upcoming Branch
                   24.09.08
         Assignee: Mridul Pathak
       Resolution: Fixed

> updateContactList service does not enforce marketing UPDATE permission
> ----------------------------------------------------------------------
>
>                 Key: OFBIZ-13672
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13672
>             Project: OFBiz
>          Issue Type: Bug
>          Components: marketing
>    Affects Versions: Upcoming Branch, 24.09.07
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Minor
>             Fix For: Upcoming Branch, 24.09.08
>
>
> {{updateContactList}} (applications/marketing/servicedef/services.xml) is missing a {{<permission-service>}} check, unlike its sibling services {{createContactList}} (CREATE) and {{removeContactList}} (DELETE) in the same file. Any authenticated user with access to the marketing webapp can call {{updateContactList}} to modify an arbitrary {{ContactList}} record's fields without the {{marketingPermissionService}} UPDATE check that equivalent services enforce elsewhere in this file.
> h3. Steps to reproduce / affected code
> * {{applications/marketing/servicedef/services.xml}}, the {{updateContactList}} service definition (~line 170), has no {{<permission-service service-name="marketingPermissionService" main-action="UPDATE"/>}} element.
> * It is exposed via {{/marketing/control/updateContactList}} (applications/marketing/webapp/marketing/WEB-INF/controller.xml) with only {{auth="true"}}, i.e. any logged-in user, not a specific marketing permission.
> h3. Suggested fix
> Add {{<permission-service service-name="marketingPermissionService" main-action="UPDATE"/>}} to the {{updateContactList}} service definition, consistent with {{createContactList}} and {{removeContactList}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)