(ofbiz-framework) branch trunk updated: Fixed: Payment method create services accept a caller-supplied paymentMethodId without verifying it belongs to the authorized party (OFBIZ-13671)

[mr...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new bd05804356 Fixed: Payment method create services accept a caller-supplied paymentMethodId without verifying it belongs to the authorized party (OFBIZ-13671)
bd05804356 is described below

commit bd05804356c0b5107e7c546bdf743d6e33df0437
Author: Mridul Pathak <mr...@gmail.com>
AuthorDate: Mon Oct 12 16:52:49 2026 +0530

    Fixed: Payment method create services accept a caller-supplied paymentMethodId without verifying it belongs to the authorized party (OFBIZ-13671)
    
    - createCreditCard, createGiftCard, createEftAccount, and createCheckAccount now reject a supplied paymentMethodId that already belongs to a different party.
    - Added the shared checkPaymentMethodOwnership helper and the AccountingPaymentMethodIdBelongsToAnotherParty error label.
---
 .../accounting/config/AccountingUiLabels.xml       |  3 ++
 .../accounting/payment/PaymentMethodServices.java  | 39 ++++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/applications/accounting/config/AccountingUiLabels.xml b/applications/accounting/config/AccountingUiLabels.xml
index 9fcd5ecfbc..ab3b7a6479 100644
--- a/applications/accounting/config/AccountingUiLabels.xml
+++ b/applications/accounting/config/AccountingUiLabels.xml
@@ -11386,6 +11386,9 @@
         <value xml:lang="zh">会计支付方法标识........</value>
         <value xml:lang="zh-TW">會計支付方法識別........</value>
     </property>
+    <property key="AccountingPaymentMethodIdBelongsToAnotherParty">
+        <value xml:lang="en">Payment Method ID is already in use.</value>
+    </property>
     <property key="AccountingPaymentMethodIdMissing">
         <value xml:lang="ar">دليل طريقة الدفع مفقود</value>
         <value xml:lang="de">Zahlungsmethode fehlt</value>
diff --git a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java
index 8f8e85f46a..1ba7131845 100644
--- a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java
+++ b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/payment/PaymentMethodServices.java
@@ -53,6 +53,25 @@ public class PaymentMethodServices {
     private static final String RESOURCE = "AccountingUiLabels";
     private static final String RES_ERROR = "AccountingUiLabels";
 
+    /**
+     * A create service may be called with a caller-supplied paymentMethodId instead of letting one be
+     * auto-sequenced. If that id already belongs to a PaymentMethod owned by a different party, creating under
+     * that id would overwrite the existing owner's record, so this is rejected rather than allowed through.
+     * @return an error Map if paymentMethodId already belongs to a different party, otherwise null
+     */
+    private static Map<String, Object> checkPaymentMethodOwnership(Delegator delegator, String paymentMethodId, String partyId, Locale locale) {
+        try {
+            GenericValue existingPm = EntityQuery.use(delegator).from("PaymentMethod").where("paymentMethodId", paymentMethodId).queryOne();
+            if (existingPm != null && !partyId.equals(existingPm.getString("partyId"))) {
+                return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE, "AccountingPaymentMethodIdBelongsToAnotherParty", locale));
+            }
+        } catch (GenericEntityException e) {
+            Debug.logWarning(e.getMessage(), MODULE);
+            return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE, "AccountingPaymentMethodIdBelongsToAnotherParty", locale));
+        }
+        return null;
+    }
+
     /**
      * Deletes a PaymentMethod entity according to the parameters passed in the context
      * <b>security check</b>: userLogin partyId must equal paymentMethod partyId, or must have PAY_INFO_DELETE permission
@@ -185,6 +204,11 @@ public class PaymentMethodServices {
                 return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
                         "AccountingCreditCardCreateIdGenerationFailure", locale));
             }
+        } else {
+            Map<String, Object> ownershipError = checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+            if (ownershipError != null) {
+                return ownershipError;
+            }
         }
 
         newPm.set("partyId", partyId);
@@ -523,6 +547,11 @@ public class PaymentMethodServices {
                 return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
                         "AccountingGiftCardCannotBeCreated", locale));
             }
+        } else {
+            Map<String, Object> ownershipError = checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+            if (ownershipError != null) {
+                return ownershipError;
+            }
         }
 
         newPm.set("partyId", partyId);
@@ -719,6 +748,11 @@ public class PaymentMethodServices {
                 return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
                         "AccountingEftAccountCannotBeCreated", locale));
             }
+        } else {
+            Map<String, Object> ownershipError = checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+            if (ownershipError != null) {
+                return ownershipError;
+            }
         }
 
         newPm.set("partyId", partyId);
@@ -957,6 +991,11 @@ public class PaymentMethodServices {
             } catch (IllegalArgumentException e) {
                 return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR, "AccountingCheckNotAdded", locale));
             }
+        } else {
+            Map<String, Object> ownershipError = checkPaymentMethodOwnership(delegator, newPmId, partyId, locale);
+            if (ownershipError != null) {
+                return ownershipError;
+            }
         }
 
         newPm.set("partyId", partyId);