[
https://issues.apache.org/jira/browse/OFBIZ-6605?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jacques Le Roux closed OFBIZ-6605.
----------------------------------
Resolution: Fixed
Fix Version/s: Upcoming Branch
13.07.03
12.04.06
14.12.01
Thanks Forrest,
I committed a very simple fix in
trunk r1702704
R14.12 r1702705
R13.07 r1702706
R12.04 r1702707
> createQuoteRole, createContentRole, and createRequirementRole allow for
> adding Roles to a Party without permissions
> -------------------------------------------------------------------------------------------------------------------
>
> Key: OFBIZ-6605
> URL: https://issues.apache.org/jira/browse/OFBIZ-6605
> Project: OFBiz
> Issue Type: Bug
> Components: content, order
> Affects Versions: Release Branch 11.04, Release Branch 13.07, Release
> Branch 14.12, Trunk
> Reporter: Forrest Rae
> Assignee: Jacques Le Roux
> Labels: security
> Fix For: 14.12.01, 12.04.06, 13.07.03, Upcoming Branch
>
>
> The following functions automatically add a PartyRole entry if the PartyRole
> does not exist. This is possible even when the userLogin doesn't have
> PARTYMGR_UPDATE or PARTYMGR_CREATE.
> createQuoteRole
> createContentRole
> createRequirementRole
> Repo:
> 1) Remove PARTYMGR_UPDATE or PARTYMGR_CREATE permissions from the ORDERENTRY
> group.
> 2) Login as DemoRepStore
> 3) Create a Quote
> 4) Add a QuoteRole with partyId of DemoRepStore and Role of your choosing.
> 5) View DemoRepStore roles.
> This is a security problem for anyone building component that leverages Role
> based security.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
