(ofbiz-framework) branch release24.09 updated: Fixed: Add permission check for runAsSystemUser in CoreEvents

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new c91d238a86 Fixed: Add permission check for runAsSystemUser in CoreEvents
c91d238a86 is described below

commit c91d238a86e0de2e3a5a084b524acbda6d4f2ac7
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Fri May 8 19:16:58 2026 +0200

    Fixed: Add permission check for runAsSystemUser in CoreEvents
    
    (cherry picked from commit c8d9f4868e82a0faab8d6b010d8f20d2454421df)
---
 .../webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
index be4ebfcc43..dabc221d8d 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
@@ -125,6 +125,9 @@ public class CoreEvents {
         String serviceCnt = (String) params.remove("SERVICE_COUNT");
         String retryCnt = (String) params.remove("SERVICE_MAXRETRY");
         String runAsSystemUser = (String) params.remove("SERVICE_RUN_AS_SYSTEM");
+        if (!security.hasPermission("SERVICE_RSAS_VIEW", userLogin)) {
+            runAsSystemUser = "N";
+        }
 
         // the frequency map
         Map<String, Integer> freqMap = new HashMap<>();