Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0021648Openbravo ERPA. Platformpublic2012-09-13 20:462012-09-26 17:19
Reporterdmitry_mezentsev 
Assigned ToAugustoMauch 
PriorityhighSeveritymajorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Versionpi 
Target VersionFixed in Version3.0MP16 
Merge Request Status
Review Assigned ToAugustoMauch
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0021648: User that has a readonly access to the record can delete its attachment or add new
DescriptionUser that has a readonly access to the record can delete its attachment

User can also add attachments to the read-only record. IMHO should not be the case.
Steps To Reproducelive.buils.pi as of 13.09.2012

1. Login with Openbravo / openbravo.
2. Switch the role to System Admin.
3. Launch Currency window and add attachment to any record.
4. Change the role to F&B Int. Group Admin or log in with a user that does not have System Admin role.
5. Go to the Currency window. It is read-only.
6. Check attachments section. Attachment can be deleted.
7. And user can also add new attachments.
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2012-09-13 20:46dmitry_mezentsevNew Issue
2012-09-13 20:46dmitry_mezentsevAssigned To => AugustoMauch
2012-09-13 20:46dmitry_mezentsevModules => Core
2012-09-13 20:55dmitry_mezentsevPrioritylow => high
2012-09-13 20:55dmitry_mezentsevSeverityminor => major
2012-09-14 17:02hgbotCheckin
2012-09-14 17:02hgbotNote Added: 0052146
2012-09-14 17:02hgbotStatusnew => resolved
2012-09-14 17:02hgbotResolutionopen => fixed
2012-09-14 17:02hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/3fec9dfdd73575e50184f738e47fc3057e545ecf [^]
2012-09-14 17:03AugustoMauchClosed by => AugustoMauch
2012-09-14 17:03AugustoMauchStatusresolved => closed
2012-09-14 17:03AugustoMauchFixed in Version => 3.0MP16
2012-09-26 17:19hudsonbotCheckin
2012-09-26 17:19hudsonbotNote Added: 0052764

Notes
(0052146)
hgbot   
2012-09-14 17:02   
Repository: erp/devel/pi
Changeset: 3fec9dfdd73575e50184f738e47fc3057e545ecf
Author: Shankar Balachandran <shankar.balachandran <at> openbravo.com>
Date: Fri Sep 14 16:51:05 2012 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/3fec9dfdd73575e50184f738e47fc3057e545ecf [^]

Fixes Issue 21648 : Adding Read-Only Logic to Attachments

When User has read-only access, they can download attachments, but they cannot add/remove attachments.

---
M modules/org.openbravo.client.application/web/org.openbravo.client.application/js/form/ob-view-form-attachments.js
M modules/org.openbravo.client.application/web/org.openbravo.client.application/js/toolbar/ob-toolbar.js
---
(0052764)
hudsonbot   
2012-09-26 17:19   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/b780e90c6452 [^]

Maturity status: Test