You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by ja...@apache.org on 2026/05/10 08:14:44 UTC
(ofbiz-framework) branch trunk updated (5ac9920db8 -> f05a0c2268)
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a change to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from 5ac9920db8 Ofbiz 13374 Fixed: incorrect Groovy range iteration that was causing index out of bounds (#1177)
new c09ee1cdad Fixed: Update permission checks in CommonScreens.xml for webtools access
new 1a012021ea Fixed: Add sun.util.calendar.ZoneInfo to allowList in SafeObjectInputStream configuration
new f05a0c2268 Fixed: Add permission checks for SERVICE_MAINT in CoreEvents to enhance security
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
framework/base/config/SafeObjectInputStream.properties | 2 +-
.../org/apache/ofbiz/base/util/SafeObjectInputStream.java | 3 ++-
.../java/org/apache/ofbiz/webapp/event/CoreEvents.java | 15 ++++++++++++++-
framework/webtools/widget/CommonScreens.xml | 9 ++++-----
4 files changed, 21 insertions(+), 8 deletions(-)
(ofbiz-framework) 03/03: Fixed: Add permission checks for SERVICE_MAINT in CoreEvents to enhance security
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit f05a0c2268f163573a0e0895ec381593de1283db
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Sun May 10 09:57:52 2026 +0200
Fixed: Add permission checks for SERVICE_MAINT in CoreEvents to enhance security
---
.../java/org/apache/ofbiz/webapp/event/CoreEvents.java | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
index acffefec86..f84beac86d 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java
@@ -113,6 +113,12 @@ public class CoreEvents {
Locale locale = UtilHttp.getLocale(request);
TimeZone timeZone = UtilHttp.getTimeZone(request);
+ if (!security.hasPermission("SERVICE_MAINT", userLogin)) {
+ String errMsg = UtilProperties.getMessage(ERR_RESOURCE, "coreEvents.not_authorized_to_call", locale);
+ request.setAttribute("_ERROR_MESSAGE_", errMsg);
+ return "error";
+ }
+
Map<String, Object> params = UtilHttp.getParameterMap(request);
// get the schedule parameters
String jobName = (String) params.remove("JOB_NAME");
@@ -434,11 +440,19 @@ public class CoreEvents {
* @return Response code string
*/
public static String runService(HttpServletRequest request, HttpServletResponse response) {
+ Security security = (Security) request.getAttribute("security");
+ GenericValue userLogin = (GenericValue) request.getSession().getAttribute("userLogin");
// get the mode and service name
String serviceName = request.getParameter("serviceName");
String mode = request.getParameter("mode");
Locale locale = UtilHttp.getLocale(request);
+ if (!security.hasPermission("SERVICE_MAINT", userLogin)) {
+ String errMsg = UtilProperties.getMessage(ERR_RESOURCE, "coreEvents.not_authorized_to_call", locale);
+ request.setAttribute("_ERROR_MESSAGE_", errMsg);
+ return "error";
+ }
+
if (UtilValidate.isEmpty(serviceName)) {
String errMsg = UtilProperties.getMessage(ERR_RESOURCE, "coreEvents.must_specify_service_name", locale);
request.setAttribute("_ERROR_MESSAGE_", errMsg);
@@ -450,7 +464,6 @@ public class CoreEvents {
}
// now do a security check
- Security security = (Security) request.getAttribute("security");
LocalDispatcher dispatcher = (LocalDispatcher) request.getAttribute("dispatcher");
//lookup the service definition to see if this service is externally available, if not require the SERVICE_INVOKE_ANY permission
(ofbiz-framework) 02/03: Fixed: Add sun.util.calendar.ZoneInfo to allowList in SafeObjectInputStream configuration
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 1a012021eacc1adb8618ec2c809f758c1ac1ab74
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Sun May 10 09:30:45 2026 +0200
Fixed: Add sun.util.calendar.ZoneInfo to allowList in SafeObjectInputStream configuration
---
framework/base/config/SafeObjectInputStream.properties | 2 +-
.../main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/framework/base/config/SafeObjectInputStream.properties b/framework/base/config/SafeObjectInputStream.properties
index 3e6fda2e74..7f759b66f5 100644
--- a/framework/base/config/SafeObjectInputStream.properties
+++ b/framework/base/config/SafeObjectInputStream.properties
@@ -27,7 +27,7 @@
# . don't forget to add new objects in SafeObjectInputStream class too (as default there).
# . "foo" and "SerializationInjector" are used in OFBiz tests
-allowList=byte\\[\\], foo, SerializationInjector, \\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java..*, org.apache.ofbiz..*, org.codehaus.groovy.runtime.GStringImpl, groovy.lang.GString
+allowList=byte\\[\\], foo, SerializationInjector, \\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java..*, org.apache.ofbiz..*, org.codehaus.groovy.runtime.GStringImpl, groovy.lang.GString, sun.util.calendar.ZoneInfo
#-- List of strings rejected for serialisation
#-- The same comments than for allowList apply to denyList
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
index aedea1a082..9fe35b58f9 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
@@ -68,7 +68,8 @@ public final class SafeObjectInputStream extends ObjectInputStream {
"org\\.apache\\.ofbiz\\.entity\\.GenericValue",
"org\\.apache\\.ofbiz\\.entity\\.GenericPK",
"org\\.codehaus\\.groovy\\.runtime\\.GStringImpl",
- "groovy\\.lang\\.GString"};
+ "groovy\\.lang\\.GString",
+ "sun\\.util\\.calendar\\.ZoneInfo"};
private static final String[] DEFAULT_DENYLIST = {"rmi", "<"};
/** The regular expression used to match serialized types. */
(ofbiz-framework) 01/03: Fixed: Update permission checks in CommonScreens.xml for webtools access
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit c09ee1cdad7ad19532919722a7ab897788a49edf
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Sun May 10 09:28:02 2026 +0200
Fixed: Update permission checks in CommonScreens.xml for webtools access
---
framework/webtools/widget/CommonScreens.xml | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/framework/webtools/widget/CommonScreens.xml b/framework/webtools/widget/CommonScreens.xml
index 17dd97b31d..c9c4952666 100644
--- a/framework/webtools/widget/CommonScreens.xml
+++ b/framework/webtools/widget/CommonScreens.xml
@@ -153,7 +153,7 @@ under the License.
<decorator-section name="pre-body">
<section>
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="SERVICE_MAINT"/>
</condition>
<widgets>
<include-menu name="ServiceTabBar" location="component://webtools/widget/Menus.xml"/>
@@ -164,7 +164,7 @@ under the License.
<section>
<!-- do check for WEBTOOLS, _VIEW permission -->
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="SERVICE_MAINT"/>
</condition>
<widgets>
<decorator-section-include name="body"/>
@@ -297,7 +297,7 @@ under the License.
<decorator-section name="pre-body">
<section>
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="PORTALPAGE_ADMIN"/>
</condition>
<widgets>
<include-menu name="GeoManagement" location="component://webtools/widget/Menus.xml"/>
@@ -306,9 +306,8 @@ under the License.
</decorator-section>
<decorator-section name="body">
<section>
- <!-- do check for WEBTOOLS, _VIEW permission -->
<condition>
- <if-has-permission permission="WEBTOOLS" action="_VIEW"/>
+ <if-has-permission permission="PORTALPAGE_ADMIN"/>
</condition>
<widgets>
<decorator-section-include name="body"/>