Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0029760Openbravo ERPA. Platformpublic2015-02-23 18:262015-05-05 08:07
Reportermaite 
Assigned Toinigosanchez 
PriorityimmediateSeverityminorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version3.0PR15Q1.4Fixed in Version3.0PR15Q1.4 
Merge Request Status
Review Assigned Toalostale
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression levelProduction - Confirmed Stable
Regression date2014-11-13
Regression introduced in release3.0PR15Q1
Regression introduced by commithttps://code.openbravo.com/erp/devel/pi/rev/c0aa8da15e9c [^]
Triggers an Emergency PackNo
Summary0029760: Process definition containing parameters defined as "window", should automatically inherit permissions
DescriptionProcess definition containing parameters defined as "window", should automatically inherit permissions
Steps To Reproduce1. Access application and change to use a manual role, as "España Finance"
2. Access Sales Invoice "1000133" and run "Add payment" process
3. Realize that no data is shown in "Order/Invoice" grid. Problem is that this role has not access to windows contained in that process definition.

Following error can be found in openbravo.log:

2015-02-23 18:16:27,072 [ajp-localhost%2F127.0.0.1-8809-10] ERROR org.openbravo.client.kernel.KernelUtils - AccessTableNoView
org.openbravo.client.kernel.OBUserException: AccessTableNoView
    at org.openbravo.service.datasource.DataSourceServlet.doPost(DataSourceServlet.java:742)
    
Proposed Solution
Additional Information
TagsApproved
Relationships
blocks defect 0029035 closed inigosanchez Process definition containing parameters defined as "window", should automatically inherit permissions 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2015-05-04 12:15alostaleTypedefect => backport
2015-05-04 12:15alostaleTarget Version => 3.0PR15Q1.4
2015-05-04 12:25ngarciaIssue Monitored: ngarcia
2015-05-04 12:46dmitry_mezentsevTag Attached: Approved
2015-05-04 14:45inigosanchezIssue Monitored: alostale
2015-05-04 14:51inigosanchezReview Assigned To => alostale
2015-05-04 14:52hgbotCheckin
2015-05-04 14:52hgbotNote Added: 0076947
2015-05-04 14:52hgbotStatusscheduled => resolved
2015-05-04 14:52hgbotResolutionopen => fixed
2015-05-04 14:52hgbotFixed in SCM revision => http://code.openbravo.com/erp/backports/3.0PR15Q1.4/rev/083eafe9b829ae26676427c11680caefc39ce38b [^]
2015-05-05 08:07alostaleNote Added: 0076980
2015-05-05 08:07alostaleStatusresolved => closed
2015-05-05 08:07alostaleFixed in Version => 3.0PR15Q1.4

Notes
(0076947)
hgbot   
2015-05-04 14:52   
Repository: erp/backports/3.0PR15Q1.4
Changeset: 083eafe9b829ae26676427c11680caefc39ce38b
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Mon May 04 14:06:00 2015 +0200
URL: http://code.openbravo.com/erp/backports/3.0PR15Q1.4/rev/083eafe9b829ae26676427c11680caefc39ce38b [^]

Fixed bug 29760:Problems with inherited permissions in process definition

The problem was that when a process containing parameters defined as "window" is
launched , this manual role has not access to windows contained in that process
definition.

The cause of this issue is that before 14Q3, no security check was done on P&E
grids, so data always was retrieved.From 15Q1, security is checked requiring
explicit access to P&E grid.

The issue is fixed by inheriting access from the process, this is if the process
is accessible the grid within the P&E doesn't require to have explicit access
but inherits from the process itself.

---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/process/BaseProcessActionHandler.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DataSourceServlet.java
---
(0076980)
alostale   
2015-05-05 08:07   
code reviewed

tested in:
* Process defined as a button in a standard window
* Process accessed from menu