Improved: Replaced permission-service with required-permissions in order to
perform permission checks in a way that is more consistent with the screen
permissions set in the ecommerce blog/forum screens.
Fixes CVE-2019-10073
<service name="createArticleContent" engine="simple" transaction-timeout="300" auth="true"
location="component://content/minilang/content/ContentServices.xml" invoke="createArticleContent">
<description>Creates content records for a blog entry</description>
- <permission-service service-name="genericContentPermission" main-action="CREATE"/>
+ <required-permissions join-type="AND">
+ <check-permission permission="CONTENTMGR" action="_CREATE"/>
+ </required-permissions>
<implements service="createContentFromUploadedFile" optional="true"/>
<implements service="createTextContent" optional="true"/>
<attribute name="contentIdFrom" type="String" mode="IN" optional="false">
<service name="createBlogEntry" engine="simple" auth="true"
location="component://content/minilang/blog/BlogServices.xml" invoke="createBlogEntry">
<description>Creates content records for a blog entry</description>
- <permission-service service-name="genericContentPermission" main-action="CREATE"/>
+ <required-permissions join-type="AND">
+ <check-permission permission="CONTENTMGR" action="_CREATE"/>
+ </required-permissions>
<implements service="uploadFileInterface" optional="true"/>
<attribute name="blogContentId" type="String" mode="INOUT" optional="false">
<type-validate>
<service name="updateBlogEntry" engine="simple" auth="true"
location="component://content/minilang/blog/BlogServices.xml" invoke="updateBlogEntry">
<description>Updates content records for a blog entry</description>
- <permission-service service-name="genericContentPermission" main-action="CREATE"/>
+ <required-permissions join-type="AND">
+ <check-permission permission="CONTENTMGR" action="_UPDATE"/>
+ </required-permissions>
<implements service="uploadFileInterface" optional="true"/>
<attribute name="blogContentId" type="String" mode="INOUT" optional="false">
<type-validate>
