(ofbiz-framework) branch trunk updated: Fixed: Hardens security by adding missing permission check in OrderServices (#2217)

[lfinster]

This is an automated email from the ASF dual-hosted git repository.

Lukas-Finster pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new df3aa3c824 Fixed: Hardens security by adding missing permission check 
in OrderServices (#2217)
df3aa3c824 is described below

commit df3aa3c824fb43e560625d8a9d3a38ace7187c7a
Author: Lukas-Finster <lukas.fins...@ecomify.de>
AuthorDate: Thu Oct 8 08:41:27 2026 +0200

    Fixed: Hardens security by adding missing permission check in OrderServices 
(#2217)
---
 .../src/main/java/org/apache/ofbiz/order/order/OrderServices.java  | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
index 2ce471b7d0..49dfed97dd 100644
--- 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
+++ 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
@@ -3881,6 +3881,13 @@ public class OrderServices {
         GenericValue userLogin = (GenericValue) context.get("userLogin");
         Locale locale = (Locale) context.get("locale");
         String orderId = (String) context.get("orderId");
+        Security security = dctx.getSecurity();
+
+        if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE", 
security, delegator)) {
+            return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
+                    "OrderYouDoNotHavePermissionToChangeThisOrdersStatus", 
locale));
+        }
+
         Map<String, String> overridePriceMap = 
UtilGenerics.cast(context.get("overridePriceMap"));
         Map<String, String> itemDescriptionMap = 
UtilGenerics.cast(context.get("itemDescriptionMap"));
         Map<String, String> itemPriceMap = 
UtilGenerics.cast(context.get("itemPriceMap"));