From 67dcf684391ebe5e45b4d71869e0a338371aab7b Mon Sep 17 00:00:00 2001
From: Jacopo Cappellato <jacopo.cappellato@gmail.com>
Date: Tue, 2 Jun 2026 19:27:54 +0200
Subject: [PATCH 1/3] Add unrestricted security permissions for Content Manager
 operations

These permissions should only be granted to trusted administrative users, as they may be harmful.
---
 applications/datamodel/data/demo/ContentDemoData.xml | 7 +++++++
 applications/datamodel/data/seed/ContentSeedData.xml | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/applications/datamodel/data/demo/ContentDemoData.xml b/applications/datamodel/data/demo/ContentDemoData.xml
index d78b667b052..12c7bf78d49 100644
--- a/applications/datamodel/data/demo/ContentDemoData.xml
+++ b/applications/datamodel/data/demo/ContentDemoData.xml
@@ -19,6 +19,13 @@ under the License.
 -->
 <entity-engine-xml>
     <!-- Content Manager security -->
+    <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FULLADMIN" permissionId="CONTENTMGR_SUPER_ADMIN"/>
+    <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_CREATE"/>
+    <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_DELETE"/>
+    <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_UPDATE"/>
+    <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_VIEW"/>
+    <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="VIEWADMIN" permissionId="CONTENTMGR_SUPER_VIEW"/>
+
     <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FULLADMIN" permissionId="CONTENTMGR_ADMIN"/>
     <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_CREATE"/>
     <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_DELETE"/>
diff --git a/applications/datamodel/data/seed/ContentSeedData.xml b/applications/datamodel/data/seed/ContentSeedData.xml
index ef329b14c15..793092fdb9f 100644
--- a/applications/datamodel/data/seed/ContentSeedData.xml
+++ b/applications/datamodel/data/seed/ContentSeedData.xml
@@ -2093,6 +2093,11 @@ ${txt}
     <DataResource dataResourceId="HELP_TEMPL" dataResourceTypeId="OFBIZ_FILE" objectInfo="applications/content/template/HelpTemplate.ftl" dataTemplateTypeId="FTL" statusId="CTNT_IN_PROGRESS" dataResourceName="Help template file" mimeTypeId="text/html" isPublic="Y"/>
 
     <!-- Content Manager security -->
+    <SecurityPermission description="View operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_VIEW"/>
+    <SecurityPermission description="Create operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_CREATE"/>
+    <SecurityPermission description="Update operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_UPDATE"/>
+    <SecurityPermission description="Delete operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_DELETE"/>
+    <SecurityPermission description="ALL operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_ADMIN"/>
     <SecurityPermission description="View operations in the Content Manager." permissionId="CONTENTMGR_VIEW"/>
     <SecurityPermission description="Create operations in the Content Manager." permissionId="CONTENTMGR_CREATE"/>
     <SecurityPermission description="Update operations in the Content Manager." permissionId="CONTENTMGR_UPDATE"/>
@@ -2106,6 +2111,7 @@ ${txt}
     <SecurityPermission description="Limited Delete operations in the Content Manager." permissionId="CONTENTMGR_ROLE_DELETE"/>
 
     <!-- add admin to SUPER permission group -->
+    <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPER" permissionId="CONTENTMGR_SUPER_ADMIN"/>
     <SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPER" permissionId="CONTENTMGR_ADMIN"/>
 
     <DataResource dataResourceId="NOCONTENTFOUND" dataResourceTypeId="OFBIZ_FILE" dataTemplateTypeId="NONE" objectInfo="/applications/content/webapp/content/images/nocontentfound.png"

From 1af8700862e3fc05d6edd4a24fe6008074da931e Mon Sep 17 00:00:00 2001
From: Jacopo Cappellato <jacopo.cappellato@gmail.com>
Date: Tue, 2 Jun 2026 19:30:54 +0200
Subject: [PATCH 2/3] Implement special permission handling for DataResource
 CRUD operations when the dataTemplateTypeId attribute is set

---
 .../DataResourcePermissionServices.xml         | 18 ++++++++++++++++++
 applications/content/servicedef/services.xml   |  1 +
 2 files changed, 19 insertions(+)

diff --git a/applications/content/minilang/permission/DataResourcePermissionServices.xml b/applications/content/minilang/permission/DataResourcePermissionServices.xml
index 3ef085d9618..66140191e14 100644
--- a/applications/content/minilang/permission/DataResourcePermissionServices.xml
+++ b/applications/content/minilang/permission/DataResourcePermissionServices.xml
@@ -21,6 +21,24 @@
         xmlns="http://ofbiz.apache.org/Simple-Method" xsi:schemaLocation="http://ofbiz.apache.org/Simple-Method http://ofbiz.apache.org/dtds/simple-methods.xsd">
 
     <simple-method method-name="genericDataResourcePermission" short-description="Generic Service for DataResource Permissions">
+        <!-- Operating with DataResources containing templates requires special permission -->
+        <if>
+            <condition>
+                <and>
+                    <not>
+                        <if-empty field="parameters.dataTemplateTypeId"/>
+                    </not>
+                    <if-compare field="parameters.dataTemplateTypeId" value="NONE" operator="not-equals"/>
+                </and>
+            </condition>
+            <then>
+                <set field="primaryPermission" value="CONTENTMGR_SUPER"/>
+                <call-simple-method method-name="genericBasePermissionCheck"
+                                    xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
+                <return/>
+            </then>
+        </if>
+
         <set field="primaryPermission" value="CONTENTMGR"/>
         <call-simple-method method-name="genericBasePermissionCheck" xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
 
diff --git a/applications/content/servicedef/services.xml b/applications/content/servicedef/services.xml
index 24fb5c21974..43302627738 100644
--- a/applications/content/servicedef/services.xml
+++ b/applications/content/servicedef/services.xml
@@ -898,6 +898,7 @@
         <description>Generic DataResource Permission Service; Takes mainAction to determine the mode.</description>
         <implements service="permissionInterface"/>
         <attribute name="dataResourceId" type="String" mode="IN" optional="true"/>
+        <attribute name="dataTemplateTypeId" type="String" mode="IN" optional="true"/>
     </service>
 
     <service name="createContentAlternativeUrl" engine="groovy"

From 716d51cb969a02b046e9d6bf8f406808aa8e7d59 Mon Sep 17 00:00:00 2001
From: Jacopo Cappellato <jacopo.cappellato@gmail.com>
Date: Tue, 2 Jun 2026 20:39:32 +0200
Subject: [PATCH 3/3] Refactor DataResource permission handling to use
 genericBasePermissionCheck service instead of the deprecated Minilang method

---
 .../permission/DataResourcePermissionServices.xml        | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/applications/content/minilang/permission/DataResourcePermissionServices.xml b/applications/content/minilang/permission/DataResourcePermissionServices.xml
index 66140191e14..b1d99544105 100644
--- a/applications/content/minilang/permission/DataResourcePermissionServices.xml
+++ b/applications/content/minilang/permission/DataResourcePermissionServices.xml
@@ -32,9 +32,12 @@
                 </and>
             </condition>
             <then>
-                <set field="primaryPermission" value="CONTENTMGR_SUPER"/>
-                <call-simple-method method-name="genericBasePermissionCheck"
-                                    xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
+                <set field="inParams.primaryPermission" value="CONTENTMGR_SUPER"/>
+                <set field="inParams.mainAction" from-field="parameters.mainAction"/>
+                <call-service service-name="genericBasePermissionCheck" in-map-name="inParams">
+                    <result-to-field result-name="hasPermission"/>
+                </call-service>
+                <field-to-result field="hasPermission"/>
                 <return/>
             </then>
         </if>