This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 124855ba1a Fixed: Require the ORDERMGR_UPDATE permission in the
updateTrackingNumber service
124855ba1a is described below
commit 124855ba1a2603617e11526fa7b9253a68103230
Author: Mridul Pathak <[email protected]>
AuthorDate: Sun Oct 18 18:42:19 2026 +0530
Fixed: Require the ORDERMGR_UPDATE permission in the updateTrackingNumber
service
The updateTrackingNumber service changed the tracking number of an order
ship group without checking any permission, unlike sibling order-update
services such as updateOrderHeader. It now requires an authenticated user with
the ORDERMGR_UPDATE permission.
---
applications/order/servicedef/services.xml | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/applications/order/servicedef/services.xml
b/applications/order/servicedef/services.xml
index 74b9ed49c2..e46150fc1d 100644
--- a/applications/order/servicedef/services.xml
+++ b/applications/order/servicedef/services.xml
@@ -299,9 +299,12 @@ under the License.
<attribute name="paymentId" type="String" mode="OUT" optional="false"/>
</service>
- <service name="updateTrackingNumber" engine="java"
+ <service name="updateTrackingNumber" engine="java" auth="true"
location="org.apache.ofbiz.order.order.OrderServices"
invoke="updateTrackingNumber">
<description>Sets the tracking number on a shipment
preference</description>
+ <required-permissions join-type="AND">
+ <check-permission permission="ORDERMGR" action="_UPDATE"/>
+ </required-permissions>
<attribute name="orderId" type="String" mode="IN" optional="false">
<type-validate>
<fail-property resource="OrderErrorUiLabels"
property="OrderRequiredFieldMissingOrderId"/>
