0029326: attachment download from multi record does not perform correct organization access check

Openbravo Issue Tracking System - Openbravo ERP

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0029326

Openbravo ERP

A. Platform

public

2015-03-18 09:18

2015-03-20 12:35

Reporter

alostale

Assigned To

alostale

Priority

urgent

Severity

minor

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

Fixed in Version

3.0PR15Q2

Merge Request Status

Review Assigned To

AugustoMauch

OBNetwork customer

Web browser

Modules

Core

Support ticket

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0029326: attachment download from multi record does not perform correct organization access check

Description

When downloading attachments the attachment's record's organization is checked to guarantee current user has access to it. Note this is done a extra security check to prevent direct requests to ungranted records but it is not possible to do it from UI.

This check is not correctly done when downloading attachments from different records at once.

Steps To Reproduce

It can't be reproduced from UI.

Two ways:
1. Generate a request to download attachments from multiple records, being at least one of them in an organization the current session doesn't have access to.
  --> ERROR: it is allowed but it shouldn't
2. Debug org.openbravo.erpCommon.businessUtility.TabAttachments.printPageFileMultiple and download attachments from several records at once.
  --> ERROR: SecurityChecker is bypassed because object is null in this code
        if (object instanceof OrganizationEnabled) {
          SecurityChecker.getInstance().checkReadableAccess((OrganizationEnabled) object);
        }

Proposed Solution

Additional Information