(ofbiz-framework) branch release24.09 updated: Fix: Adds missing CREATE and UPDATE accounting permissions (#2211)

[lfinster]

This is an automated email from the ASF dual-hosted git repository.

Lukas-Finster pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new b1c4e25ea2 Fix: Adds missing CREATE and UPDATE accounting permissions 
(#2211)
b1c4e25ea2 is described below

commit b1c4e25ea265abea1547bd8a125c561c518d4338
Author: Lukas-Finster <lukas.fins...@ecomify.de>
AuthorDate: Thu Oct 8 08:40:29 2026 +0200

    Fix: Adds missing CREATE and UPDATE accounting permissions (#2211)
---
 .../org/apache/ofbiz/accounting/payment/PaymentServices.groovy     | 3 +++
 .../java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java  | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git 
a/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
 
b/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
index 9914ed75f1..a3b1e6b4cc 100644
--- 
a/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
+++ 
b/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
@@ -738,6 +738,9 @@ Map createPaymentFromOrder() {
 }
 
 Map createPaymentApplication() {
+    if (!security.hasEntityPermission('ACCOUNTING', '_CREATE', 
parameters.userLogin)) {
+        return error(label('AccountingUiLabels', 
'AccountingPaymentAuthorizationFailed'))
+    }
     // Create a Payment Application
     if (!parameters.invoiceId && !parameters.billingAccountId && 
!parameters.taxAuthGeoId && !parameters.toPaymentId) {
         return error(label('AccountingUiLabels', 
'AccountingPaymentApplicationParameterMissing'))
diff --git 
a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
 
b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
index 1312e2c01d..8b5f4b2ff3 100644
--- 
a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
+++ 
b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
@@ -62,6 +62,7 @@ import org.apache.ofbiz.entity.util.EntityUtil;
 import org.apache.ofbiz.entity.util.EntityUtilProperties;
 import org.apache.ofbiz.order.order.OrderReadHelper;
 import org.apache.ofbiz.product.product.ProductWorker;
+import org.apache.ofbiz.security.Security;
 import org.apache.ofbiz.service.DispatchContext;
 import org.apache.ofbiz.service.GenericServiceException;
 import org.apache.ofbiz.service.LocalDispatcher;
@@ -2685,7 +2686,13 @@ public class InvoiceServices {
     public static Map<String, Object> 
updatePaymentApplicationDefBd(DispatchContext dctx, Map<String, Object> 
context) {
         Delegator delegator = dctx.getDelegator();
         Locale locale = (Locale) context.get("locale");
+        Security security = dctx.getSecurity();
+        GenericValue userLogin = (GenericValue) context.get("userLogin");
 
+        if (!security.hasEntityPermission("ACCOUNTING", "_UPDATE", userLogin)) 
{
+            return 
ServiceUtil.returnError(UtilProperties.getMessage("AccountingUiLabels",
+                    "AccountingPaymentAuthorizationFailed", locale));
+        }
         if (DECIMALS == -1 || ROUNDING == null) {
             return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
                     "AccountingAritmeticPropertiesNotConfigured", locale));