Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0014677Openbravo ERPA. Platformpublic2010-09-23 15:052010-10-16 00:00
Reporterplujan 
Assigned Toalostale 
PriorityurgentSeveritymajorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Versionmain 
Target Version2.50MP23Fixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0014677: DE008 It is possible to bypass the security check and use an expired commercial module
DescriptionIt is possible to bypass the security check and use an expired commercial module
Steps To Reproduce1. Use an instance with an active subscription. IDL module is installed, but the subscription for IDL has expired yesterday.
2. Login with "userA" a non SysAdmin user. You will receive the expected message. It is not possible to log in.
3. Login with "QA" a SysAdmin user. You will receive the expected message, and you are allowed to continue.
4. Go to Module Management window. Select IDL module and disable it.
5. Open a new browser. Log in with userA. Now there is no message and you can log in.
6. Check that IDL menu entry is not there (since it is disabled)
7. In the QA session (the browser used to disable), enable IDL
8. Refresh userA browser using F5. Now IDL menu entry is there and you are able to open the window and use IDL as usual.
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2010-09-23 15:05plujanNew Issue
2010-09-23 15:05plujanAssigned To => alostale
2010-09-27 08:59alostaleStatusnew => scheduled
2010-09-30 15:03alostaleNote Added: 0031521
2010-09-30 15:05hgbotCheckin
2010-09-30 15:05hgbotNote Added: 0031522
2010-09-30 15:05hgbotStatusscheduled => resolved
2010-09-30 15:05hgbotResolutionopen => fixed
2010-09-30 15:05hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/09be3c03a880475617c4537a10e653945a716b1f [^]
2010-10-08 20:59hudsonbotCheckin
2010-10-08 20:59hudsonbotNote Added: 0031710
2010-10-15 16:12marvintmNote Added: 0031882
2010-10-15 16:12marvintmStatusresolved => closed
2010-10-16 00:00anonymoussf_bug_id0 => 3088372

Notes
(0031521)
alostale   
2010-09-30 15:03   
The problem is in step 4: it should not be allowed to enable again disabled commercial modules which license has expired.
(0031522)
hgbot   
2010-09-30 15:05   
Repository: erp/devel/pi
Changeset: 09be3c03a880475617c4537a10e653945a716b1f
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Thu Sep 30 15:04:49 2010 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/09be3c03a880475617c4537a10e653945a716b1f [^]

fixed issue 14677: It is possible to use an expired commercial module

  Disabled commercial modules which license has expired are not allowed
  to be enabled again.

---
M src/org/openbravo/erpCommon/ad_forms/ModuleManagement.java
M src/org/openbravo/erpCommon/obps/ActivationKey.java
---
(0031710)
hudsonbot   
2010-10-08 20:59   
A changeset related to this issue has been promoted to main after passing a series of tests and an OBX has been generated:

Changeset: http://code.openbravo.com/erp/devel/main/rev/09be3c03a880 [^]
Merge Changeset: http://code.openbravo.com/erp/devel/main/rev/f476e192559f [^]
Tests: http://builds.openbravo.com/view/int/ [^]
OBX: http://builds.openbravo.com/erp/core/obx/OpenbravoERP-2.50CI.18505.obx [^]
(0031882)
marvintm   
2010-10-15 16:12   
Verified that you cannot enable a disabled module you don't have rights to in your license. Also, verified that if you later get the rights to the module and update the license, you can enable the module again.