(ofbiz-framework) branch trunk updated: Fixed: Adds missing CREATE and UPDATE accounting permissions (#2212)

[lfinster]

This is an automated email from the ASF dual-hosted git repository.

Lukas-Finster pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 9866d9d4ed Fixed: Adds missing CREATE and UPDATE accounting 
permissions  (#2212)
9866d9d4ed is described below

commit 9866d9d4ed299b4b8b4bf4371fce2d10f0bd0c0b
Author: Lukas-Finster <lukas.fins...@ecomify.de>
AuthorDate: Thu Oct 8 08:40:59 2026 +0200

    Fixed: Adds missing CREATE and UPDATE accounting permissions  (#2212)
---
 .../org/apache/ofbiz/accounting/payment/PaymentServices.groovy     | 3 +++
 .../java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java  | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git 
a/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
 
b/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
index b4820f5fa6..69060328b0 100644
--- 
a/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
+++ 
b/applications/accounting/src/main/groovy/org/apache/ofbiz/accounting/payment/PaymentServices.groovy
@@ -724,6 +724,9 @@ Map createPaymentFromOrder() {
 }
 
 Map createPaymentApplication() {
+    if (!security.hasEntityPermission('ACCOUNTING', '_CREATE', 
parameters.userLogin)) {
+        return error(label('AccountingUiLabels', 
'AccountingPaymentAuthorizationFailed'))
+    }
     // Create a Payment Application
     require(parameters.invoiceId || parameters.billingAccountId || 
parameters.taxAuthGeoId || parameters.toPaymentId,
             label('AccountingUiLabels', 
'AccountingPaymentApplicationParameterMissing'))
diff --git 
a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
 
b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
index 1312e2c01d..8b5f4b2ff3 100644
--- 
a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
+++ 
b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/invoice/InvoiceServices.java
@@ -62,6 +62,7 @@ import org.apache.ofbiz.entity.util.EntityUtil;
 import org.apache.ofbiz.entity.util.EntityUtilProperties;
 import org.apache.ofbiz.order.order.OrderReadHelper;
 import org.apache.ofbiz.product.product.ProductWorker;
+import org.apache.ofbiz.security.Security;
 import org.apache.ofbiz.service.DispatchContext;
 import org.apache.ofbiz.service.GenericServiceException;
 import org.apache.ofbiz.service.LocalDispatcher;
@@ -2685,7 +2686,13 @@ public class InvoiceServices {
     public static Map<String, Object> 
updatePaymentApplicationDefBd(DispatchContext dctx, Map<String, Object> 
context) {
         Delegator delegator = dctx.getDelegator();
         Locale locale = (Locale) context.get("locale");
+        Security security = dctx.getSecurity();
+        GenericValue userLogin = (GenericValue) context.get("userLogin");
 
+        if (!security.hasEntityPermission("ACCOUNTING", "_UPDATE", userLogin)) 
{
+            return 
ServiceUtil.returnError(UtilProperties.getMessage("AccountingUiLabels",
+                    "AccountingPaymentAuthorizationFailed", locale));
+        }
         if (DECIMALS == -1 || ROUNDING == null) {
             return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
                     "AccountingAritmeticPropertiesNotConfigured", locale));