This is an automated email from the ASF dual-hosted git repository.
ashishvijaywargiya pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 764f989972 Improved: authorization checks on Catalog and Order Manager
helper routes (#1717) (#1728)
764f989972 is described below
commit 764f9899729cdcd76cb967fac4f3dc93377963d5
Author: Ashish Vijaywargiya <[email protected]>
AuthorDate: Tue Aug 25 09:44:53 2026 +0530
Improved: authorization checks on Catalog and Order Manager helper routes
(#1717) (#1728)
Cherry-picked from trunk commit
b874c2a952891d2a817e07359102d304af96d738. Applied cleanly with no
adjustments.
Thank you Krishna Uprit for your contribution.
Co-authored-by: Krishna Uprit <[email protected]>
---
applications/order/webapp/ordermgr/WEB-INF/controller.xml | 4 ++--
applications/product/config/ProductErrorUiLabels.xml | 3 +++
.../org/apache/ofbiz/product/category/CategoryServices.java | 11 +++++++++++
.../org/apache/ofbiz/product/store/ProductStoreEvents.java | 13 +++++++++++++
applications/product/webapp/catalog/WEB-INF/controller.xml | 4 ++--
5 files changed, 31 insertions(+), 4 deletions(-)
diff --git a/applications/order/webapp/ordermgr/WEB-INF/controller.xml
b/applications/order/webapp/ordermgr/WEB-INF/controller.xml
index 6fd65ef329..f8490a0d64 100644
--- a/applications/order/webapp/ordermgr/WEB-INF/controller.xml
+++ b/applications/order/webapp/ordermgr/WEB-INF/controller.xml
@@ -674,7 +674,7 @@ under the License.
<response name="error" type="request" value="orderentry"/>
</request-map>
<request-map uri="quickadd">
- <security https="false" auth="false"/>
+ <security https="true" auth="true"/>
<response name="success" type="view" value="quickadd"/>
</request-map>
@@ -2057,7 +2057,7 @@ under the License.
<view-map name="category" type="screen"
page="component://order/widget/ordermgr/OrderEntryCatalogScreens.xml#category"/>
<view-map name="product" type="screen"
page="component://order/widget/ordermgr/OrderEntryCatalogScreens.xml#product"/>
<view-map name="compareProducts" type="screen"
page="component://order/widget/ordermgr/OrderEntryCatalogScreens.xml#compareProducts"/>
- <view-map name="quickadd" type="screen"
page="component://order/widget/ordermgr/OrderEntryCatalogScreens.xml#quickadd"
auth="false"/>
+ <view-map name="quickadd" type="screen"
page="component://order/widget/ordermgr/OrderEntryCatalogScreens.xml#quickadd"/>
<view-map name="AddGiftCertificate" type="screen"
page="component://order/widget/ordermgr/OrderEntryCartScreens.xml#AddGiftCertificate"/>
<view-map name="custsetting" type="screen"
page="component://order/widget/ordermgr/OrderEntryOrderScreens.xml#CustSettings"/>
diff --git a/applications/product/config/ProductErrorUiLabels.xml
b/applications/product/config/ProductErrorUiLabels.xml
index 0906a9d058..a07f80ecc3 100644
--- a/applications/product/config/ProductErrorUiLabels.xml
+++ b/applications/product/config/ProductErrorUiLabels.xml
@@ -1614,4 +1614,7 @@
<property key="ProductRequiredFieldMissingTotalIssuedQty">
<value xml:lang="en">Required Field Missing :Total Issued Qty. </value>
</property>
+ <property key="CatalogViewPermissionError">
+ <value xml:lang="en">You do not have permission to view Catalog
Manager category data.</value>
+ </property>
</resource>
diff --git
a/applications/product/src/main/java/org/apache/ofbiz/product/category/CategoryServices.java
b/applications/product/src/main/java/org/apache/ofbiz/product/category/CategoryServices.java
index feea3d6ba7..29c48a4fd9 100644
---
a/applications/product/src/main/java/org/apache/ofbiz/product/category/CategoryServices.java
+++
b/applications/product/src/main/java/org/apache/ofbiz/product/category/CategoryServices.java
@@ -32,6 +32,7 @@ import org.apache.ofbiz.base.util.Debug;
import org.apache.ofbiz.base.util.GeneralException;
import org.apache.ofbiz.base.util.UtilDateTime;
import org.apache.ofbiz.base.util.UtilGenerics;
+import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilProperties;
import org.apache.ofbiz.base.util.UtilValidate;
@@ -46,6 +47,7 @@ import org.apache.ofbiz.entity.util.EntityQuery;
import org.apache.ofbiz.entity.util.EntityUtil;
import org.apache.ofbiz.product.catalog.CatalogWorker;
import org.apache.ofbiz.product.product.ProductWorker;
+import org.apache.ofbiz.security.Security;
import org.apache.ofbiz.service.DispatchContext;
import org.apache.ofbiz.service.LocalDispatcher;
import org.apache.ofbiz.service.ServiceUtil;
@@ -461,6 +463,15 @@ public class CategoryServices {
// Please note : the structure of map in this function is according to the
JSON data map of the jsTree
@SuppressWarnings("unchecked")
public static String getChildCategoryTree(HttpServletRequest request,
HttpServletResponse response) {
+ Security security = (Security) request.getAttribute("security");
+ if (security == null || !security.hasEntityPermission("CATALOG",
"_VIEW", request.getSession())) {
+ String errMsg = UtilProperties.getMessage(RES_ERROR,
"CatalogViewPermissionError", UtilHttp.getLocale(request));
+ request.setAttribute("_ERROR_MESSAGE_", errMsg);
+ response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+ Debug.logWarning("Unauthorized attempt to access getChild by
productCategoryId param [%s]", MODULE,
+ request.getParameter("productCategoryId"));
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productCategoryId = request.getParameter("productCategoryId");
String isCatalog = request.getParameter("isCatalog");
diff --git
a/applications/product/src/main/java/org/apache/ofbiz/product/store/ProductStoreEvents.java
b/applications/product/src/main/java/org/apache/ofbiz/product/store/ProductStoreEvents.java
index 2188f55d83..303d811c37 100644
---
a/applications/product/src/main/java/org/apache/ofbiz/product/store/ProductStoreEvents.java
+++
b/applications/product/src/main/java/org/apache/ofbiz/product/store/ProductStoreEvents.java
@@ -27,19 +27,32 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilMisc;
+import org.apache.ofbiz.base.util.UtilProperties;
import org.apache.ofbiz.base.util.UtilValidate;
import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.GenericEntityException;
import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityQuery;
+import org.apache.ofbiz.security.Security;
public class ProductStoreEvents {
private static final String MODULE = ProductStoreWorker.class.getName();
+ private static final String RES_ERROR = "ProductErrorUiLabels";
// Please note : the structure of map in this function is according to the
JSON data map of the jsTree
public static String getChildProductStoreGroupTree(HttpServletRequest
request, HttpServletResponse response) {
+ Security security = (Security) request.getAttribute("security");
+ if (security == null || !security.hasEntityPermission("CATALOG",
"_VIEW", request.getSession())) {
+ String errMsg = UtilProperties.getMessage(RES_ERROR,
"CatalogViewPermissionError", UtilHttp.getLocale(request));
+ request.setAttribute("_ERROR_MESSAGE_", errMsg);
+ response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+ Debug.logWarning("Unauthorized attempt to access
getProductStoreGroupRollupHierarchy by parentGroupId param [%s]", MODULE,
+ request.getParameter("parentGroupId"));
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String parentGroupId = request.getParameter("parentGroupId");
String onclickFunction = request.getParameter("onclickFunction");
diff --git a/applications/product/webapp/catalog/WEB-INF/controller.xml
b/applications/product/webapp/catalog/WEB-INF/controller.xml
index edfbe0ba37..9d28160946 100644
--- a/applications/product/webapp/catalog/WEB-INF/controller.xml
+++ b/applications/product/webapp/catalog/WEB-INF/controller.xml
@@ -1467,7 +1467,7 @@ under the License.
<response name="error" type="view" value="EditProductStoreGroup"/>
</request-map>
<request-map uri="getProductStoreGroupRollupHierarchy">
- <security auth="false" https="true"/>
+ <security auth="true" https="true"/>
<event type="java"
path="org.apache.ofbiz.product.store.ProductStoreEvents"
invoke="getChildProductStoreGroupTree"/>
<response name="success" type="request" value="json"/>
<response name="error" type="request" value="json"/>
@@ -3026,7 +3026,7 @@ under the License.
</request-map>
<request-map uri="getChild">
- <security auth="false" https="true"/>
+ <security auth="true" https="true"/>
<event type="java"
path="org.apache.ofbiz.product.category.CategoryServices"
invoke="getChildCategoryTree"/>
<response name="success" type="request" value="json"/>
<response name="error" type="request" value="json"/>
