Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0024858Openbravo ERPA. Platformpublic2013-10-01 11:592014-02-12 18:28
Reportercaristu 
Assigned Todbaz 
PriorityhighSeverityminorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version3.0PR14Q2Fixed in Version3.0PR14Q2 
Merge Request Status
Review Assigned Toalostale
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0024858: Restrict access to REST web services
DescriptionThe Openbravo REST web services use the same access/authorizations as the standard Openbravo application, so if a role is able to access a to the information of a table, the entity associated to this table is accessible for this role through its corresponding REST webservice.

It would be nice to have a mechanism to allow us to restrict access just to the web service for a particular role and at the same time this role would be able access to the window.
Steps To Reproduce.
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
related to defect 0026566 closed guillermogil error is returned when a call to web service is done and the role used don't have permission to Role and User window 
Attached Files? wsRolSec.export (22,570) 2013-12-19 13:51
https://issues.openbravo.com/file_download.php?file_id=6580&type=bug
Issue History
Date ModifiedUsernameFieldChange
2013-10-01 11:59caristuNew Issue
2013-10-01 11:59caristuAssigned To => AugustoMauch
2013-10-01 11:59caristuModules => Core
2013-10-01 11:59caristuTriggers an Emergency Pack => No
2013-12-18 18:00dbazAssigned ToAugustoMauch => dbaz
2013-12-18 18:01dbazIssue Monitored: alostale
2013-12-18 18:01dbazReview Assigned To => alostale
2013-12-18 18:02dbazIssue Monitored: dbaz
2013-12-18 18:02dbazFile Added: wsRolSec.diff
2013-12-19 11:43dbazFile Deleted: wsRolSec.diff
2013-12-19 11:43dbazFile Added: wsRolSec.export
2013-12-19 13:51dbazFile Deleted: wsRolSec.export
2013-12-19 13:51dbazFile Added: wsRolSec.export
2014-01-20 08:24alostaleTarget Version => 3.0MP32
2014-01-20 14:51hgbotCheckin
2014-01-20 14:51hgbotNote Added: 0063538
2014-01-20 14:51hgbotStatusnew => resolved
2014-01-20 14:51hgbotResolutionopen => fixed
2014-01-20 14:51hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/267df0f85b0e2084cbe4f0555be9552615ec17f0 [^]
2014-01-28 08:06alostaleNote Added: 0063734
2014-01-28 08:06alostaleStatusresolved => closed
2014-01-28 08:06alostaleFixed in Version => 3.0MP32
2014-02-12 18:28hudsonbotCheckin
2014-02-12 18:28hudsonbotNote Added: 0064092
2014-05-16 12:30guillermogilRelationship addedrelated to 0026566

Notes
(0063538)
hgbot   
2014-01-20 14:51   
Repository: erp/devel/pi
Changeset: 267df0f85b0e2084cbe4f0555be9552615ec17f0
Author: David Baz Fayos <david.baz <at> openbravo.com>
Date: Mon Jan 20 14:50:37 2014 +0100
URL: http://code.openbravo.com/erp/devel/pi/rev/267df0f85b0e2084cbe4f0555be9552615ec17f0 [^]

Fixed issue 24858: Added 'Is Web Service Enabled' field to 'Role' window

---
M modules/org.openbravo.service.json/src/org/openbravo/service/json/JsonRestServlet.java
M referencedata/sampledata/F_B_International_Group/AD_ROLE.xml
M referencedata/sampledata/QA_Testing/AD_ROLE.xml
M src-db/database/model/tables/AD_ROLE.xml
M src-db/database/sourcedata/AD_COLUMN.xml
M src-db/database/sourcedata/AD_ELEMENT.xml
M src-db/database/sourcedata/AD_FIELD.xml
M src/org/openbravo/service/web/BaseWebServiceServlet.java
---
(0063734)
alostale   
2014-01-28 08:06   
Code reviewed + tested for:
-Standard XML Web Services
-Standard JSON Web Services
-Manually implemented Web Services
(0064092)
hudsonbot   
2014-02-12 18:28   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/d1a5bb862230 [^]
Maturity status: Test