You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "mridulpathak (via GitHub)" <gi...@apache.org> on 2026/10/20 09:05:42 UTC
[PR] Fixed: Check the owner of the shopping list in checkShoppingListSecurity [ofbiz-framework]
mridulpathak opened a new pull request, #2376:
URL: https://github.com/apache/ofbiz-framework/pull/2376
checkShoppingListSecurity only compared the partyId passed to the service with the logged-in user, and did not look at who owns the shopping list being updated or removed. It now loads the list when a shoppingListId is passed and requires the logged-in user to be its owner or to have the PARTYMGR permission, as checkShoppingListItemSecurity already does for list items.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fixed: Check the owner of the shopping list in checkShoppingListSecurity [ofbiz-framework]
Posted by "golja (via GitHub) via notifications" <no...@ofbiz.apache.org>.
golja commented on PR #2376:
URL: https://github.com/apache/ofbiz-framework/pull/2376#issuecomment-6637175130
CVE-2026-114271
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fixed: Check the owner of the shopping list in checkShoppingListSecurity [ofbiz-framework]
Posted by "mridulpathak (via GitHub)" <gi...@apache.org>.
mridulpathak merged PR #2376:
URL: https://github.com/apache/ofbiz-framework/pull/2376
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org