This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 290afc2d65 Fixed: Missing permission checks on FinAccount
GL-reconciliation services (OFBIZ-13683)
290afc2d65 is described below
commit 290afc2d65c721082620c5e3735429b3165c4b1e
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Oct 14 10:20:22 2026 +0530
Fixed: Missing permission checks on FinAccount GL-reconciliation services
(OFBIZ-13683)
Several GL-reconciliation services (reconcileFinAccountTrans,
assignGlRecToFinAccTrans, removeFinAccountTransFromReconciliation,
cancelBankReconciliation) had neither auth nor a permission-service, so any
authenticated session could assign, remove, or cancel bank-reconciliation
associations on arbitrary FinAccountTrans records directly. This adds the
existing acctgFinAcctPermissionCheck permission-service to each of these
service definitions, matching the convention already used for s [...]
---
applications/accounting/servicedef/services_finaccount.xml | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/applications/accounting/servicedef/services_finaccount.xml
b/applications/accounting/servicedef/services_finaccount.xml
index 2a952f692c..7faabd214d 100644
--- a/applications/accounting/servicedef/services_finaccount.xml
+++ b/applications/accounting/servicedef/services_finaccount.xml
@@ -247,9 +247,10 @@ under the License.
<attribute name="finAccountTransRunningTotal" type="String" mode="OUT"
optional="true"/>
<attribute name="endingBalance" type="String" mode="OUT"
optional="true"/>
</service>
- <service name="reconcileFinAccountTrans" engine="simple"
+ <service name="reconcileFinAccountTrans" engine="simple" auth="true"
location="component://accounting/minilang/finaccount/FinAccountServices.xml"
invoke="reconcileFinAccountTrans">
<description>Reconcile Financial Accounting Financial
Transactions</description>
+ <permission-service service-name="acctgFinAcctPermissionCheck"
main-action="UPDATE"/>
<attribute name="finAccountTransId" type="String" mode="IN"
optional="false"/>
<attribute name="organizationPartyId" type="String" mode="IN"
optional="false"/>
<attribute name="glAccountId" type="String" mode="IN" optional="true"/>
@@ -489,16 +490,18 @@ under the License.
<attribute name="grandTotal" type="BigDecimal" mode="OUT"
optional="true"/>
</service>
- <service name="assignGlRecToFinAccTrans" engine="simple"
+ <service name="assignGlRecToFinAccTrans" engine="simple" auth="true"
location="component://accounting/minilang/finaccount/FinAccountServices.xml"
invoke="assignGlRecToFinAccTrans">
<description>Assignment of Gl Reconciliation to Fin Account
Trans</description>
+ <permission-service service-name="acctgFinAcctPermissionCheck"
main-action="UPDATE"/>
<attribute name="finAccountTransId" type="String" mode="IN"
optional="false"/>
<attribute name="glReconciliationId" type="String" mode="IN"
optional="false"/>
</service>
- <service name="removeFinAccountTransFromReconciliation" engine="simple"
+ <service name="removeFinAccountTransFromReconciliation" engine="simple"
auth="true"
location="component://accounting/minilang/finaccount/FinAccountServices.xml"
invoke="removeFinAccountTransFromReconciliation">
<description>Remove finaAccountTrans association with gl
reconciliation</description>
+ <permission-service service-name="acctgFinAcctPermissionCheck"
main-action="UPDATE"/>
<attribute name="finAccountTransId" type="String" mode="IN"
optional="false"/>
</service>
@@ -509,9 +512,10 @@ under the License.
<attribute name="isReconciled" type="Boolean" mode="OUT"
optional="false"/>
</service>
- <service name="cancelBankReconciliation" engine="simple"
+ <service name="cancelBankReconciliation" engine="simple" auth="true"
location="component://accounting/minilang/finaccount/FinAccountServices.xml"
invoke="cancelBankReconciliation">
<description>Cancel bank reconciliation.</description>
+ <permission-service service-name="acctgFinAcctPermissionCheck"
main-action="UPDATE"/>
<attribute name="glReconciliationId" type="String" mode="IN"
optional="false"/>
</service>
