Skip to content

Fixed: Improve DataResource permission service #1320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacopoc merged 3 commits into from
Jun 4, 2026
+35 −0
Merged

Fixed: Improve DataResource permission service #1320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
67dcf68
Add unrestricted security permissions for Content Manager operations
jacopoc Jun 2, 2026
1af8700
Implement special permission handling for DataResource CRUD operation…
jacopoc Jun 2, 2026
716d51c
Refactor DataResource permission handling to use genericBasePermissio…
jacopoc Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions applications/content/minilang/permission/DataResourcePermissionServices.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,27 @@
xmlns="http://ofbiz.apache.org/Simple-Method" xsi:schemaLocation="http://ofbiz.apache.org/Simple-Method http://ofbiz.apache.org/dtds/simple-methods.xsd">

<simple-method method-name="genericDataResourcePermission" short-description="Generic Service for DataResource Permissions">
<!-- Operating with DataResources containing templates requires special permission -->
<if>
<condition>
<and>
<not>
<if-empty field="parameters.dataTemplateTypeId"/>
</not>
<if-compare field="parameters.dataTemplateTypeId" value="NONE" operator="not-equals"/>
</and>
</condition>
<then>
<set field="inParams.primaryPermission" value="CONTENTMGR_SUPER"/>
<set field="inParams.mainAction" from-field="parameters.mainAction"/>
<call-service service-name="genericBasePermissionCheck" in-map-name="inParams">
<result-to-field result-name="hasPermission"/>
</call-service>
<field-to-result field="hasPermission"/>
<return/>
</then>
</if>

<set field="primaryPermission" value="CONTENTMGR"/>
<call-simple-method method-name="genericBasePermissionCheck" xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>

Expand Down
1 change: 1 addition & 0 deletions applications/content/servicedef/services.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -898,6 +898,7 @@
<description>Generic DataResource Permission Service; Takes mainAction to determine the mode.</description>
<implements service="permissionInterface"/>
<attribute name="dataResourceId" type="String" mode="IN" optional="true"/>
<attribute name="dataTemplateTypeId" type="String" mode="IN" optional="true"/>
</service>

<service name="createContentAlternativeUrl" engine="groovy"
Expand Down
7 changes: 7 additions & 0 deletions applications/datamodel/data/demo/ContentDemoData.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,13 @@ under the License.
-->
<entity-engine-xml>
<!-- Content Manager security -->
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FULLADMIN" permissionId="CONTENTMGR_SUPER_ADMIN"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_CREATE"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_DELETE"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_UPDATE"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_SUPER_VIEW"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="VIEWADMIN" permissionId="CONTENTMGR_SUPER_VIEW"/>

<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FULLADMIN" permissionId="CONTENTMGR_ADMIN"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_CREATE"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="FLEXADMIN" permissionId="CONTENTMGR_DELETE"/>
Expand Down
6 changes: 6 additions & 0 deletions applications/datamodel/data/seed/ContentSeedData.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2093,6 +2093,11 @@ ${txt}
<DataResource dataResourceId="HELP_TEMPL" dataResourceTypeId="OFBIZ_FILE" objectInfo="applications/content/template/HelpTemplate.ftl" dataTemplateTypeId="FTL" statusId="CTNT_IN_PROGRESS" dataResourceName="Help template file" mimeTypeId="text/html" isPublic="Y"/>

<!-- Content Manager security -->
<SecurityPermission description="View operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_VIEW"/>
<SecurityPermission description="Create operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_CREATE"/>
<SecurityPermission description="Update operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_UPDATE"/>
<SecurityPermission description="Delete operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_DELETE"/>
<SecurityPermission description="ALL operations in the Content Manager without restrictions." permissionId="CONTENTMGR_SUPER_ADMIN"/>
<SecurityPermission description="View operations in the Content Manager." permissionId="CONTENTMGR_VIEW"/>
<SecurityPermission description="Create operations in the Content Manager." permissionId="CONTENTMGR_CREATE"/>
<SecurityPermission description="Update operations in the Content Manager." permissionId="CONTENTMGR_UPDATE"/>
Expand All @@ -2106,6 +2111,7 @@ ${txt}
<SecurityPermission description="Limited Delete operations in the Content Manager." permissionId="CONTENTMGR_ROLE_DELETE"/>

<!-- add admin to SUPER permission group -->
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPER" permissionId="CONTENTMGR_SUPER_ADMIN"/>
<SecurityGroupPermission fromDate="2001-05-13 12:00:00.0" groupId="SUPER" permissionId="CONTENTMGR_ADMIN"/>

<DataResource dataResourceId="NOCONTENTFOUND" dataResourceTypeId="OFBIZ_FILE" dataTemplateTypeId="NONE" objectInfo="/applications/content/webapp/content/images/nocontentfound.png"
Expand Down
Loading