Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0012652Openbravo ERPZ. Otherspublic2010-03-11 14:262010-04-16 00:00
Reporteralostale 
Assigned Toadrianromero 
PriorityimmediateSeveritymajorReproducibilityN/A
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version2.50MP14Fixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0012652: Proper management of DAL security
DescriptionAs found in issue 0012651, some code is using DAL without managing security properly.

More info can be found here [1]

[1] http://forge.openbravo.com/plugins/espforum/view.php?group_id=100&forumid=549512&topicid=7010557 [^]
Steps To Reproduce
Proposed SolutionCheck and fix if needed core code using DAL.

This is the list of files that use DAL in current pi (36fdbf2c73bb)

./org/openbravo/base/secureApp/HttpSecureAppServlet.java
./org/openbravo/base/secureApp/OrgTreeNode.java
./org/openbravo/base/secureApp/LoginHandler.java
./org/openbravo/base/secureApp/VariablesSecureApp.java
./org/openbravo/reference/ui/UIList.java
./org/openbravo/reference/Reference.java
./org/openbravo/erpCommon/ad_actionButton/InvoicePaymentMonitor.java
./org/openbravo/erpCommon/ad_actionButton/ExportReferenceData.java
./org/openbravo/erpCommon/ad_process/HeartbeatProcess.java
./org/openbravo/erpCommon/ad_process/KillSession.java
./org/openbravo/erpCommon/ad_process/PaymentMonitor.java
./org/openbravo/erpCommon/ad_process/TestHeartbeat.java
./org/openbravo/erpCommon/ad_process/PaymentMonitorProcess.java
./org/openbravo/erpCommon/ad_process/CreateCustomModule.java
./org/openbravo/erpCommon/ad_process/ApplyModules.java
./org/openbravo/erpCommon/ad_process/AcctServerProcess.java
./org/openbravo/erpCommon/ad_process/UpdateAuditTrail.java
./org/openbravo/erpCommon/ad_forms/InstanceManagement.java
./org/openbravo/erpCommon/ad_forms/InitialClientSetup.java
./org/openbravo/erpCommon/ad_forms/InitialOrgSetup.java
./org/openbravo/erpCommon/ad_forms/Role.java
./org/openbravo/erpCommon/ad_forms/Registration.java
./org/openbravo/erpCommon/ad_forms/UpdateReferenceData.java
./org/openbravo/erpCommon/ad_forms/ModuleManagement.java
./org/openbravo/erpCommon/info/AttributeSetInstance.java
./org/openbravo/erpCommon/info/ImageInfoBLOB.java
./org/openbravo/erpCommon/modules/ApplyModule.java
./org/openbravo/erpCommon/modules/ModuleUtiltiy.java
./org/openbravo/erpCommon/obps/ActivationKey.java
./org/openbravo/erpCommon/obps/ActiveInstanceProcess.java
./org/openbravo/erpCommon/businessUtility/AuditTrailDeletedRecords.java
./org/openbravo/erpCommon/businessUtility/AuditTrailPopup.java
./org/openbravo/erpCommon/ad_callouts/SL_TableAudit.java
./org/openbravo/erpCommon/ad_callouts/SL_RequisitionLine_Product.java
./org/openbravo/erpCommon/ad_callouts/SL_PC_Case_Product.java
./org/openbravo/erpCommon/ad_callouts/SL_GlobalUse_Product.java
./org/openbravo/erpCommon/ad_callouts/SL_InOutLine_Product.java
./org/openbravo/erpCommon/ad_callouts/SL_Module_Minor_Version.java
./org/openbravo/erpCommon/ad_callouts/SL_Production_Product.java
./org/openbravo/erpCommon/ad_callouts/SL_Internal_Consumption_Product.java
./org/openbravo/erpCommon/ad_callouts/SL_ModuleCallout.java
./org/openbravo/erpCommon/ad_callouts/SL_Movement_Product.java
./org/openbravo/erpCommon/ad_callouts/SL_Inventory_Product.java
./org/openbravo/erpCommon/utility/Utility.java
./org/openbravo/erpCommon/utility/Register.java
./org/openbravo/erpCommon/utility/ShowImage.java
./org/openbravo/erpCommon/utility/ToolBar.java
./org/openbravo/erpCommon/utility/ImageToDatabaseLoader.java
./org/openbravo/erpCommon/utility/ShowImageLogo.java
./org/openbravo/erpCommon/utility/VerticalMenu.java
./org/openbravo/erpCommon/utility/UsedByLink.java
./org/openbravo/erpCommon/security/Menu.java
./org/openbravo/erpCommon/security/Login.java
Additional Information
TagsNo tags attached.
Relationships
related to defect 0012668pi closed eduardo_Argal Proper management of DAL security on file: src/org/openbravo/erpCommon/ad_forms/InitialOrgSetup.java 
related to defect 0012651 closed adrianromero UOM is not updated if we login as user with Material Management role. 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2010-03-11 14:26alostaleNew Issue
2010-03-11 14:26alostaleAssigned To => adrianromero
2010-03-11 14:26alostaleOBNetwork customer => No
2010-03-11 14:27alostaleRelationship addedrelated to 0012651
2010-03-11 14:33rafarodaIssue Monitored: rafaroda
2010-03-11 16:02alostaleProposed Solution updated
2010-03-11 17:48psarobeSeveritycritical => major
2010-03-11 17:48psarobeStatusnew => scheduled
2010-03-12 12:26hgbotCheckin
2010-03-12 12:26hgbotNote Added: 0025287
2010-03-12 12:40hgbotCheckin
2010-03-12 12:40hgbotNote Added: 0025288
2010-03-12 17:08hgbotCheckin
2010-03-12 17:08hgbotNote Added: 0025298
2010-03-15 13:09adrianromeroStatusscheduled => resolved
2010-03-15 13:09adrianromeroFixed in SCM revision => 64d9ea836ba2
2010-03-15 13:09adrianromeroResolutionopen => fixed
2010-03-15 13:16adrianromeroRelationship addedrelated to 0012668
2010-03-16 08:41hudsonbotCheckin
2010-03-16 08:41hudsonbotNote Added: 0025507
2010-03-16 08:41hudsonbotCheckin
2010-03-16 08:41hudsonbotNote Added: 0025508
2010-03-16 08:41hudsonbotCheckin
2010-03-16 08:41hudsonbotNote Added: 0025513
2010-04-15 11:35plujanNote Added: 0026240
2010-04-15 11:35plujanStatusresolved => closed
2010-04-16 00:00anonymoussf_bug_id0 => 2987963

Notes
(0025287)
hgbot   
2010-03-12 12:26   
Repository: erp/devel/pi
Changeset: 0512d61a86528d31c2288197a9211337cbb4e1fd
Author: Iván Perdomo <ivan.perdomo <at> openbravo.com>
Date: Fri Mar 12 12:31:57 2010 +0100
URL: http://code.openbravo.com/erp/devel/pi/rev/0512d61a86528d31c2288197a9211337cbb4e1fd [^]

Fixes DAL security issue. Related to issue 12652

---
M src/org/openbravo/erpCommon/security/Login.java
---
(0025288)
hgbot   
2010-03-12 12:40   
Repository: erp/devel/pi
Changeset: cd0c6ba4de24f06777b67097de974f6bdbf62030
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Fri Mar 12 12:46:28 2010 +0100
URL: http://code.openbravo.com/erp/devel/pi/rev/cd0c6ba4de24f06777b67097de974f6bdbf62030 [^]

related to issue 12652

---
M src/org/openbravo/erpCommon/ad_process/CreateCustomModule.java
---
(0025298)
hgbot   
2010-03-12 17:08   
Repository: erp/devel/pi
Changeset: 64d9ea836ba26834de15acf66b16bad2f632c9a6
Author: Gorka Ion Damián <gorkaion.damian <at> openbravo.com>
Date: Fri Mar 12 17:13:27 2010 +0100
URL: http://code.openbravo.com/erp/devel/pi/rev/64d9ea836ba26834de15acf66b16bad2f632c9a6 [^]

Related to issue 12652. Fixes DAL security issue.

---
M src/org/openbravo/erpCommon/ad_callouts/SL_GlobalUse_Product.java
M src/org/openbravo/erpCommon/ad_callouts/SL_Internal_Consumption_Product.java
M src/org/openbravo/erpCommon/ad_callouts/SL_Inventory_Product.java
M src/org/openbravo/erpCommon/ad_callouts/SL_Movement_Product.java
M src/org/openbravo/erpCommon/ad_callouts/SL_PC_Case_Product.java
M src/org/openbravo/erpCommon/ad_callouts/SL_Production_Product.java
M src/org/openbravo/erpCommon/ad_callouts/SL_RequisitionLine_Product.java
M src/org/openbravo/erpCommon/info/AttributeSetInstance.java
---
(0025507)
hudsonbot   
2010-03-16 08:41   
A changeset related to this issue has been promoted to main after passing a series of tests and an OBX has been generated:

Changeset: http://code.openbravo.com/erp/devel/main/rev/0512d61a8652 [^]
Merge Changeset: http://code.openbravo.com/erp/devel/main/rev/3e52c5b52d67 [^]
Tests: http://builds.openbravo.com/view/devel-int/ [^]
OBX: http://builds.openbravo.com/erp/core/obx/OpenbravoERP-2.50CI.16713.obx [^]
(0025508)
hudsonbot   
2010-03-16 08:41   
A changeset related to this issue has been promoted to main after passing a series of tests and an OBX has been generated:

Changeset: http://code.openbravo.com/erp/devel/main/rev/cd0c6ba4de24 [^]
Merge Changeset: http://code.openbravo.com/erp/devel/main/rev/3e52c5b52d67 [^]
Tests: http://builds.openbravo.com/view/devel-int/ [^]
OBX: http://builds.openbravo.com/erp/core/obx/OpenbravoERP-2.50CI.16713.obx [^]
(0025513)
hudsonbot   
2010-03-16 08:41   
A changeset related to this issue has been promoted to main after passing a series of tests and an OBX has been generated:

Changeset: http://code.openbravo.com/erp/devel/main/rev/64d9ea836ba2 [^]
Merge Changeset: http://code.openbravo.com/erp/devel/main/rev/3e52c5b52d67 [^]
Tests: http://builds.openbravo.com/view/devel-int/ [^]
OBX: http://builds.openbravo.com/erp/core/obx/OpenbravoERP-2.50CI.16713.obx [^]
(0026240)
plujan   
2010-04-15 11:35   
Since the fix has not functional impact, a code review was performed to double check the DAL management.