Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0021422Openbravo ERPC. Securitypublic2012-08-22 21:532012-09-28 14:39
Reporterpjuvara 
Assigned ToAugustoMauch 
PrioritynormalSeverityminorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version3.0MP12.1 
Target VersionFixed in Version3.0MP16 
Merge Request Status
Review Assigned Todbaz
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0021422: Client admin users can see entries that have been removed from the menu
DescriptionIf you personalize the menu by removing windows, you expect that users have no access to them anymore.
However, client admins (or users of a role with manual set to No), can see all active windows through the Quick Create and Quick Launch menu, regardless of whether they have been removed from the menu or not.
Steps To ReproduceIn standard installation:
1) Login as system administrator
2) Modify the Menu to remove for example, the Manufacturing sub menu
3) Logout
4) Login as client admin (F&B International Group Admin)
5) Review the menu and make sure that Manufacturing is not there
6) From Quick Launch, invoke "Machine" (one of the entries in Manufacturing)

The window opens.
Proposed SolutionWindows that do not appear on the menu should be considered disabled.
Additional Information
TagsNo tags attached.
Relationships
Attached Filespng MenuEntryRemoval.png (260,383) 2012-09-03 09:36
https://issues.openbravo.com/file_download.php?file_id=5545&type=bug
png
Issue History
Date ModifiedUsernameFieldChange
2012-08-22 21:53pjuvaraNew Issue
2012-08-22 21:53pjuvaraAssigned To => alostale
2012-08-22 21:53pjuvaraModules => Core
2012-09-03 09:35AugustoMauchAssigned Toalostale => AugustoMauch
2012-09-03 09:36AugustoMauchFile Added: MenuEntryRemoval.png
2012-09-03 09:45AugustoMauchNote Added: 0051756
2012-09-03 09:45AugustoMauchStatusnew => feedback
2012-09-03 15:13pjuvaraNote Added: 0051778
2012-09-03 15:13pjuvaraStatusfeedback => new
2012-09-03 15:14pjuvaraNote Added: 0051779
2012-09-03 15:14pjuvaraSeveritymajor => minor
2012-09-03 15:16pjuvaraNote Added: 0051781
2012-09-07 11:38AugustoMauchClosed by => alostale
2012-09-07 11:41hgbotCheckin
2012-09-07 11:41hgbotNote Added: 0051921
2012-09-07 11:41hgbotStatusnew => resolved
2012-09-07 11:41hgbotResolutionopen => fixed
2012-09-07 11:41hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/a8b284469c67c2c23581495f1226f2415e4a1ca4 [^]
2012-09-26 11:52AugustoMauchNote Added: 0052617
2012-09-26 11:52AugustoMauchStatusresolved => new
2012-09-26 11:52AugustoMauchResolutionfixed => open
2012-09-26 11:53AugustoMauchClosed byalostale => dbaz
2012-09-26 11:53AugustoMauchStatusnew => scheduled
2012-09-26 11:54AugustoMauchStatusscheduled => resolved
2012-09-26 11:54AugustoMauchResolutionopen => fixed
2012-09-26 17:18hudsonbotCheckin
2012-09-26 17:18hudsonbotNote Added: 0052707
2012-09-26 17:28hgbotCheckin
2012-09-26 17:28hgbotNote Added: 0052800
2012-09-26 17:45dbazNote Added: 0052804
2012-09-26 17:45dbazStatusresolved => closed
2012-09-26 17:45dbazFixed in Version => 3.0MP16
2012-09-28 14:39hudsonbotCheckin
2012-09-28 14:39hudsonbotNote Added: 0052912

Notes
(0051756)
AugustoMauch   
2012-09-03 09:45   
This happens because when a summary level menu entry is deleted its child menu entries are not deleted on cascade.

I have deleted the Security summary level menu entry, that has the following sub entries: User, Role, Role Access, Session, Audit Trail and Goodgle Account Association. After deleting Security, all its sub entries are placed under the root menu entry (see attached image MenuEntryRemoval.png), and remain accessible.

I think this would have been solved by deleting automatically all the subentries on cascade. Do you want us to do that?

Regards,

Augusto
(0051778)
pjuvara   
2012-09-03 15:13   
I apologize: my initial description was not clear enough.

I revised what I did and here it is. The objective was to hide Production Management from my customer's menu.
I therefore marked with Active = N the summary menu entry Production Management.

All the entries under that menu have disappeared from the menu, even if they were themselves active.

With that I had assumed that disabling the summary menu entry was enough to disable the whole tree of entries underneath it.

I later discovered that those entries are still visible in the Quick Open and Quick Create menu.

There is therefore a different semantic interpretation of the active flag in the two tools:

1) Navigation menu: show all entries that are active and have where all the ancestors are active

2) Quick Create/Open: show all entries that are active.

We should align the semantic.
(0051779)
pjuvara   
2012-09-03 15:14   
Once explained in these term (see previous note), the severity of the issue is lower.

I am also not sure whether this is a defect or a design defect.
(0051781)
pjuvara   
2012-09-03 15:16   
In any case, the solution would be to modify the Quick Create/Open so that it shows only entries that are active and were all ancestors are active.
(0051921)
hgbot   
2012-09-07 11:41   
Repository: erp/devel/pi
Changeset: a8b284469c67c2c23581495f1226f2415e4a1ca4
Author: Augusto Mauch <augusto.mauch <at> openbravo.com>
Date: Fri Sep 07 11:40:09 2012 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/a8b284469c67c2c23581495f1226f2415e4a1ca4 [^]

Fixes issue 21422: Only menu-accessible will be shown in Quick create / Open

In order for a window to be accessible through the Quick create / Open controls, it has to be accessible using the menu. The means that all its menu ancestors has to be active.

---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/MenuManager.java
---
(0052617)
AugustoMauch   
2012-09-26 11:52   
Reopened to update Closed by field
(0052707)
hudsonbot   
2012-09-26 17:18   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/b780e90c6452 [^]

Maturity status: Test
(0052800)
hgbot   
2012-09-26 17:28   
Repository: erp/devel/pi
Changeset: 8a0aed9bd90d9cac29addda0dd1791e59b1f755e
Author: Augusto Mauch <augusto.mauch <at> openbravo.com>
Date: Wed Sep 26 17:26:55 2012 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/8a0aed9bd90d9cac29addda0dd1791e59b1f755e [^]

Related to issue 21422: Code refactored so isAccessible is a MenuOption method

---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/MenuManager.java
---
(0052804)
dbaz   
2012-09-26 17:45   
Reviewed @ changeset: 18052 - 8a0aed9bd90d
(0052912)
hudsonbot   
2012-09-28 14:39   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/6d2f8cffd4b1 [^]

Maturity status: Test