This is an automated email from the ASF dual-hosted git repository.
ashishvijaywargiya pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new f018379852 Improved: Anchor catalog quick-admin write events to their
permission tier (#1739) (#1740)
f018379852 is described below
commit f0183798523e05e21db15753474a49d57502dcd1
Author: Ashish Vijaywargiya <[email protected]>
AuthorDate: Wed Aug 26 17:57:54 2026 +0530
Improved: Anchor catalog quick-admin write events to their permission tier
(#1739) (#1740)
- updateProductQuickAdminShipping, updateProductQuickAdminSelFeat,
removeFeatureApplsByFeatureTypeId, removeProductFeatureAppl,
addProductToCategories, updateProductCategoryMember, and
addProductFeatures now call the same entity-permission check already
used by their sibling methods updateAllKeywords and updateProductAssoc
in this same file, before running.
- Added a small shared helper, checkCatalogPermission, so the check is
consistent across all seven methods instead of being repeated inline.
Thank you Krishna Uprit for the contribution.
(cherry picked from commit 98d624f9cf1fb2fd6de78833c23ff4814cd74139)
Co-authored-by: Krishna Uprit <[email protected]>
Co-authored-by: Krishnauprit18 <[email protected]>
---
.../ofbiz/product/product/ProductEvents.java | 44 ++++++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git
a/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java
b/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java
index 406aaa2f04..8c6b1945f9 100644
---
a/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java
+++
b/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductEvents.java
@@ -431,7 +431,21 @@ public class ProductEvents {
return "success";
}
+ private static String checkCatalogPermission(HttpServletRequest request,
String updateMode) {
+ Security security = (Security) request.getAttribute("security");
+ if (!security.hasEntityPermission("CATALOG", "_" + updateMode,
request.getSession())) {
+ Map<String, String> messageMap = UtilMisc.toMap("updateMode",
updateMode);
+ return UtilProperties.getMessage(RESOURCE,
"productevents.not_sufficient_permissions", messageMap,
UtilHttp.getLocale(request));
+ }
+ return null;
+ }
+
public static String updateProductQuickAdminShipping(HttpServletRequest
request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "UPDATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
Timestamp nowTimestamp = UtilDateTime.nowTimestamp();
GenericValue userLogin = (GenericValue)
request.getSession().getAttribute("userLogin");
@@ -606,6 +620,11 @@ public class ProductEvents {
}
public static String updateProductQuickAdminSelFeat(HttpServletRequest
request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "UPDATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
Timestamp nowTimestamp = UtilDateTime.nowTimestamp();
String productId = request.getParameter("productId");
@@ -788,6 +807,11 @@ public class ProductEvents {
}
public static String removeFeatureApplsByFeatureTypeId(HttpServletRequest
request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "DELETE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productFeatureTypeId =
request.getParameter("productFeatureTypeId");
@@ -825,6 +849,11 @@ public class ProductEvents {
}
public static String removeProductFeatureAppl(HttpServletRequest request,
HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "DELETE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productFeatureId = request.getParameter("productFeatureId");
@@ -847,6 +876,11 @@ public class ProductEvents {
}
public static String addProductToCategories(HttpServletRequest request,
HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "CREATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String fromDateStr = request.getParameter("fromDate");
@@ -876,6 +910,11 @@ public class ProductEvents {
}
public static String updateProductCategoryMember(HttpServletRequest
request, HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "UPDATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productCategoryId = request.getParameter("productCategoryId");
@@ -902,6 +941,11 @@ public class ProductEvents {
}
public static String addProductFeatures(HttpServletRequest request,
HttpServletResponse response) {
+ String permError = checkCatalogPermission(request, "CREATE");
+ if (permError != null) {
+ request.setAttribute("_ERROR_MESSAGE_", permError);
+ return "error";
+ }
Delegator delegator = (Delegator) request.getAttribute("delegator");
String productId = request.getParameter("productId");
String productFeatureApplTypeId =
request.getParameter("productFeatureApplTypeId");
