[OFBIZ-2333] createOrderAdjustment security related error

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: Release Branch 09.04, Trunk
• Fix Version/s: Release Branch 09.04, Trunk
• Component/s: order
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Unassigned
• Reporter: Jacques Le Roux
• Created: 21/Apr/09 13:00
• Updated: 02/May/09 13:39
• Resolved: 02/May/09 13:39

Description

Another one found in error.log

2009-04-19 13:49:51,262 (TP-Processor17) [ RequestHandler.java:399:ERROR] Request createOrderAdjustment caused an error with the following message: Error calling event: org.ofbiz.webapp.event.EventHandlerException: Found URL parameter [orderId] passed to secure (https) request-map with uri [createOrderAdjustment] with an event that calls service [createOrderAdjustment]; this is not allowed for security reasons! The data should be encrypted by making it part of the request body (a form field) instead of the request URL.

but this one is another exception : (paramString contains orderId...)

<form name="addAdjustmentForm" method="post" action="<@ofbizUrl>createOrderAdjustment?${paramString}</@ofbizUrl>">

The decision on ML is to rewrite all (upstream). More work but certainly the better solution...