Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0029759Openbravo ERPA. Platformpublic2015-02-23 18:262015-05-05 08:07
Reportermaite 
Assigned Toinigosanchez 
PriorityimmediateSeverityminorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version3.0PR15Q2Fixed in Version3.0PR15Q2 
Merge Request Status
Review Assigned Toalostale
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression levelProduction - Confirmed Stable
Regression date2014-11-13
Regression introduced in release3.0PR15Q1
Regression introduced by commithttps://code.openbravo.com/erp/devel/pi/rev/c0aa8da15e9c [^]
Triggers an Emergency PackNo
Summary0029759: Process definition containing parameters defined as "window", should automatically inherit permissions
DescriptionProcess definition containing parameters defined as "window", should automatically inherit permissions
Steps To Reproduce1. Access application and change to use a manual role, as "España Finance"
2. Access Sales Invoice "1000133" and run "Add payment" process
3. Realize that no data is shown in "Order/Invoice" grid. Problem is that this role has not access to windows contained in that process definition.

Following error can be found in openbravo.log:

2015-02-23 18:16:27,072 [ajp-localhost%2F127.0.0.1-8809-10] ERROR org.openbravo.client.kernel.KernelUtils - AccessTableNoView
org.openbravo.client.kernel.OBUserException: AccessTableNoView
    at org.openbravo.service.datasource.DataSourceServlet.doPost(DataSourceServlet.java:742)
    
Proposed Solution
Additional Information
TagsApproved
Relationships
blocks defect 0029035 closed inigosanchez Process definition containing parameters defined as "window", should automatically inherit permissions 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2015-05-04 12:15alostaleTypedefect => backport
2015-05-04 12:15alostaleTarget Version => 3.0PR15Q2.1
2015-05-04 12:46dmitry_mezentsevTag Attached: Approved
2015-05-04 14:45inigosanchezIssue Monitored: alostale
2015-05-04 14:45inigosanchezReview Assigned To => alostale
2015-05-04 14:48hgbotCheckin
2015-05-04 14:48hgbotNote Added: 0076946
2015-05-04 14:48hgbotStatusscheduled => resolved
2015-05-04 14:48hgbotResolutionopen => fixed
2015-05-04 14:48hgbotFixed in SCM revision => http://code.openbravo.com/erp/backports/3.0PR15Q2/rev/6f1dbff918d98e5e88e3790dddaaec97ea76d37d [^]
2015-05-04 15:34inigosanchezTarget Version3.0PR15Q2.1 => 3.0PR15Q2
2015-05-05 08:07alostaleNote Added: 0076979
2015-05-05 08:07alostaleStatusresolved => closed
2015-05-05 08:07alostaleFixed in Version => 3.0PR15Q2

Notes
(0076946)
hgbot   
2015-05-04 14:48   
Repository: erp/backports/3.0PR15Q2
Changeset: 6f1dbff918d98e5e88e3790dddaaec97ea76d37d
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Mon May 04 14:01:49 2015 +0200
URL: http://code.openbravo.com/erp/backports/3.0PR15Q2/rev/6f1dbff918d98e5e88e3790dddaaec97ea76d37d [^]

Fixed bug 29759:Problems with inherited permissions in process definition

The problem was that when a process containing parameters defined as "window" is launched , this manual role has
not access to windows contained in that process definition.

The cause of this issue is that before 14Q3, no security check was done on P&E grids, so data always was retrieved.
From 15Q1, security is checked requiring explicit access to P&E grid.

The issue is fixed by inheriting access from the process, this is if the process is accessible the grid within the
P&E doesn't require to have explicit access but inherits from the process itself.

---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/process/BaseProcessActionHandler.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DataSourceServlet.java
---
(0076979)
alostale   
2015-05-05 08:07   
code reviewed

tested in:
* Process defined as a button in a standard window
* Process accessed from menu