diff --git a/modules/org.openbravo.client.application/src-db/database/sourcedata/AD_MESSAGE.xml b/modules/org.openbravo.client.application/src-db/database/sourcedata/AD_MESSAGE.xml
--- a/modules/org.openbravo.client.application/src-db/database/sourcedata/AD_MESSAGE.xml
+++ b/modules/org.openbravo.client.application/src-db/database/sourcedata/AD_MESSAGE.xml
@@ -242,6 +242,17 @@
+
+
+
+
+
+
+
+
+
+
+
@@ -1039,6 +1050,17 @@
+
+
+
+
+
+
+
+
+
+
+
diff --git a/modules/org.openbravo.client.application/src/org/openbravo/client/application/navigationbarcomponents/UserInfoWidgetActionHandler.java b/modules/org.openbravo.client.application/src/org/openbravo/client/application/navigationbarcomponents/UserInfoWidgetActionHandler.java
--- a/modules/org.openbravo.client.application/src/org/openbravo/client/application/navigationbarcomponents/UserInfoWidgetActionHandler.java
+++ b/modules/org.openbravo.client.application/src/org/openbravo/client/application/navigationbarcomponents/UserInfoWidgetActionHandler.java
@@ -308,7 +308,7 @@
// " AND A_U_R.AD_USER_ID = ?" +
// " ORDER BY A_R.NAME";
final OBQuery rolesQuery = OBDal.getInstance().createQuery(UserRoles.class,
- " userContact.id=? and role.active=true");
+ " userContact.id=? and role.active=true and role.isrestrictbackend=false");
rolesQuery.setFilterOnReadableClients(false);
rolesQuery.setFilterOnReadableOrganization(false);
rolesQuery.setParameters(Collections.singletonList((Object) OBContext.getOBContext().getUser()
diff --git a/src-db/database/model/tables/AD_ROLE.xml b/src-db/database/model/tables/AD_ROLE.xml
--- a/src-db/database/model/tables/AD_ROLE.xml
+++ b/src-db/database/model/tables/AD_ROLE.xml
@@ -81,6 +81,10 @@
+
+
+
+
@@ -100,5 +104,6 @@
+
diff --git a/src-db/database/sourcedata/AD_COLUMN.xml b/src-db/database/sourcedata/AD_COLUMN.xml
--- a/src-db/database/sourcedata/AD_COLUMN.xml
+++ b/src-db/database/sourcedata/AD_COLUMN.xml
@@ -305056,6 +305056,41 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src-db/database/sourcedata/AD_ELEMENT.xml b/src-db/database/sourcedata/AD_ELEMENT.xml
--- a/src-db/database/sourcedata/AD_ELEMENT.xml
+++ b/src-db/database/sourcedata/AD_ELEMENT.xml
@@ -28173,6 +28173,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src-db/database/sourcedata/AD_FIELD.xml b/src-db/database/sourcedata/AD_FIELD.xml
--- a/src-db/database/sourcedata/AD_FIELD.xml
+++ b/src-db/database/sourcedata/AD_FIELD.xml
@@ -189725,6 +189725,35 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src-db/database/sourcedata/AD_MESSAGE.xml b/src-db/database/sourcedata/AD_MESSAGE.xml
--- a/src-db/database/sourcedata/AD_MESSAGE.xml
+++ b/src-db/database/sourcedata/AD_MESSAGE.xml
@@ -16742,6 +16742,17 @@
+
+
+
+
+
+
+
+
+
+
+
@@ -22038,6 +22049,17 @@
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src-db/database/sourcedata/AD_REF_LIST.xml b/src-db/database/sourcedata/AD_REF_LIST.xml
--- a/src-db/database/sourcedata/AD_REF_LIST.xml
+++ b/src-db/database/sourcedata/AD_REF_LIST.xml
@@ -8496,6 +8496,18 @@
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src-db/database/sourcedata/M_OFFER_TYPE.xml b/src-db/database/sourcedata/M_OFFER_TYPE.xml
--- a/src-db/database/sourcedata/M_OFFER_TYPE.xml
+++ b/src-db/database/sourcedata/M_OFFER_TYPE.xml
@@ -8,6 +8,7 @@
+
diff --git a/src-db/database/sourcedata/OBCQL_WIDGET_QUERY.xml b/src-db/database/sourcedata/OBCQL_WIDGET_QUERY.xml
--- a/src-db/database/sourcedata/OBCQL_WIDGET_QUERY.xml
+++ b/src-db/database/sourcedata/OBCQL_WIDGET_QUERY.xml
@@ -18,6 +18,7 @@
and q.organization.id IN (:organizationList)
and @optional_filters@
group by q.documentStatus]]>
+
diff --git a/src/index.jsp b/src/index.jsp
--- a/src/index.jsp
+++ b/src/index.jsp
@@ -1,3 +1,4 @@
+
<%@ page import="java.util.Properties" %>
<%@ page import="org.openbravo.base.HttpBaseServlet" %>
<%@ page import="org.openbravo.dal.core.OBContext"%>
@@ -8,6 +9,9 @@
<%@ page import="org.openbravo.dal.core.OBContext" %>
<%@ page import="org.openbravo.model.ad.module.Module" %>
<%@ page import="org.apache.log4j.Logger" %>
+<%@ page import="org.openbravo.model.ad.access.Role" %>
+<%@ page import="org.openbravo.dal.service.OBDal" %>
+<%@ page import="org.openbravo.base.secureApp.VariablesSecureApp" %>
<%@ page contentType="text/html; charset=UTF-8" %>
<%
/*
@@ -160,6 +164,18 @@
// starts the application is called as the last statement in the StaticResources part
function OBStartApplication() {
+<%
+//If the role has its access to the backend restricted, an error message will be shown
+final VariablesSecureApp vars1 = new VariablesSecureApp(request, false);
+Role role = OBDal.getInstance().get(Role.class, vars1.getRole());
+if(role.isRestrictbackend()){
+%>
+ document.body.removeChild(document.getElementById('OBLoadingDiv'));
+ isc.Dialog.create({message: OB.I18N.getLabel('OBUIAPP_RestrictedUser'), title: OB.I18N.getLabel('OBUIAPP_RestrictedUserTitle'), showCloseButton: false}).show();
+ return;
+<%
+}
+%>
OB.Layout.initialize();
OB.Layout.draw();
OB.Layout.ViewManager.createAddStartTab();
diff --git a/src/org/openbravo/base/secureApp/DefaultOptions_data.xsql b/src/org/openbravo/base/secureApp/DefaultOptions_data.xsql
--- a/src/org/openbravo/base/secureApp/DefaultOptions_data.xsql
+++ b/src/org/openbravo/base/secureApp/DefaultOptions_data.xsql
@@ -37,7 +37,7 @@
INNER JOIN AD_ROLE role ON users.DEFAULT_AD_ROLE_ID = role.AD_ROLE_ID
WHERE users.AD_USER_ID = ?
AND NOT users.DEFAULT_AD_ROLE_ID IS NULL
- AND role.ISACTIVE = 'Y'
+ AND role.ISACTIVE = 'Y' and role.isrestrictbackend='N'
]]>
@@ -127,7 +127,7 @@
INNER JOIN AD_ROLE role
ON userRoles.AD_ROLE_ID = role.AD_ROLE_ID
WHERE userRoles.AD_USER_ID = ?
- AND role.ISACTIVE = 'Y'
+ AND role.ISACTIVE = 'Y' and role.isrestrictbackend='N'
]]>
diff --git a/src/org/openbravo/base/secureApp/LoginHandler.java b/src/org/openbravo/base/secureApp/LoginHandler.java
--- a/src/org/openbravo/base/secureApp/LoginHandler.java
+++ b/src/org/openbravo/base/secureApp/LoginHandler.java
@@ -33,6 +33,8 @@
import org.openbravo.erpCommon.utility.OBVersion;
import org.openbravo.erpCommon.utility.Utility;
import org.openbravo.model.ad.access.Session;
+import org.openbravo.model.ad.access.User;
+import org.openbravo.model.ad.access.UserRoles;
import org.openbravo.model.ad.module.Module;
import org.openbravo.model.ad.system.Client;
import org.openbravo.model.ad.system.SystemInformation;
@@ -63,7 +65,7 @@
final VariablesSecureApp vars = new VariablesSecureApp(req);
// Empty session
- vars.removeSessionValue("#Authenticated_user");
+ req.getSession().removeAttribute("#Authenticated_user");
vars.removeSessionValue("#AD_Role_ID");
vars.setSessionObject("#loggingIn", "Y");
@@ -228,6 +230,21 @@
break;
}
+ boolean hasNonRestrictedRole = false;
+ User user = OBDal.getInstance().get(User.class, strUserAuth);
+ for (UserRoles userrole : user.getADUserRolesList()) {
+ if (!userrole.getRole().isRestrictbackend()) {
+ hasNonRestrictedRole = true;
+ }
+ }
+ if (!hasNonRestrictedRole) {
+ String msg = Utility.messageBD(myPool, "NON_RESTRICTED_ROLE", vars.getLanguage());
+ String title = Utility.messageBD(myPool, "NON_RESTRICTED_ROLE_TITLE", vars.getLanguage());
+ updateDBSession(sessionId, false, "RESTR");
+ goToRetry(res, vars, msg, title, "Error", action, doRedirect);
+ return;
+ }
+
// Build checks
SystemInformation sysInfo = OBDal.getInstance().get(SystemInformation.class, "0");
if (sysInfo.getSystemStatus() == null || sysInfo.getSystemStatus().equals("RB70")