(ofbiz-framework) branch trunk updated: Fixed: Enforces order-update authorization in updateShipGroupShipInfo and addItemToApprovedOrder

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new a1602c5560 Fixed: Enforces order-update authorization in 
updateShipGroupShipInfo and addItemToApprovedOrder
a1602c5560 is described below

commit a1602c5560175561121990d7533b128028f7066e
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sun Oct 18 18:37:22 2026 +0530

    Fixed: Enforces order-update authorization in updateShipGroupShipInfo and 
addItemToApprovedOrder
    
    - Requires the standard order-update authorization in 
updateShipGroupShipInfo before the order is loaded into a cart for update, 
matching the pattern already used by updateApprovedOrderItems.
    - Requires the same authorization in addItemToApprovedOrder (service 
appendOrderItem) before an item is appended to an existing order.
---
 .../java/org/apache/ofbiz/order/order/OrderServices.java     | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
index f6146c95aa..eb3e9e30bd 100644
--- 
a/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
+++ 
b/applications/order/src/main/java/org/apache/ofbiz/order/order/OrderServices.java
@@ -3734,6 +3734,12 @@ public class OrderServices {
         String changeComments = (String) context.get("changeComments");
         Boolean calcTax = (Boolean) context.get("calcTax");
         Map<String, String> itemAttributesMap = 
UtilGenerics.cast(context.get("itemAttributesMap"));
+        Security security = dctx.getSecurity();
+
+        if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE", 
security, delegator)) {
+            return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+                    "OrderYouDoNotHavePermissionToChangeThisOrdersStatus", 
locale));
+        }
 
         if (calcTax == null) {
             calcTax = Boolean.TRUE;
@@ -6688,6 +6694,12 @@ public class OrderServices {
         String contactMechId = (String) context.get("contactMechId");
         String oldContactMechId = (String) context.get("oldContactMechId");
         String shipmentMethod = (String) context.get("shipmentMethod");
+        Security security = dctx.getSecurity();
+
+        if (!OrderServices.hasPermission(orderId, userLogin, "UPDATE", 
security, delegator)) {
+            return ServiceUtil.returnError(UtilProperties.getMessage(RES_ERROR,
+                    "OrderYouDoNotHavePermissionToChangeThisOrdersStatus", 
locale));
+        }
 
         //load cart from order to update new shipping method or address
         ShoppingCart shoppingCart = null;