Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0030735Openbravo ERP02. Master data managementpublic2015-09-02 10:502015-09-11 06:33
Reportermalsasua 
Assigned ToAtulOpenbravo 
PrioritynormalSeveritymajorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS20OS VersionCommunity Appliance
Product Version3.0PR15Q3 
Target VersionFixed in Version 
Merge Request Status
Review Assigned Tovmromanos
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0030735: All price lists are displayed without check the organization role
Descriptionin the window "product" tab pricelist, in some cases, all pricelists are displayed in the combo, although the role has not permission to all pricelist organizations
Steps To Reproduce. create pricelist as attachment: pl1.png
. create pricelist as attachment: pl2.png
. create role as attachment: roleOrgAccess.png and roleUser.png
. login in the ERP using the role "regionNorte"
. go to window product -> tab pricelist
. open the pricelist combo:
  all pricelist are displayed, but only should be displayed regionNorte - plv
Proposed Solutionthe problem is in the callout SL_ProductPrice_PriceListVersion, it is returned in the line 66 false, and it should return true:

https://code.openbravo.com/erp/devel/pi/file/5a14852fac16/src/org/openbravo/erpCommon/ad_callouts/SL_ProductPrice_PriceListVersion.java#l66 [^]
Additional Information
TagsNo tags attached.
Relationships
related to defect 00218213.0MP17 closed ioritzCia Prices visible in product does not belong to role 
related to defect 00307973.0PR15Q4 closed alostale Validation rule automatically adds wrong organization list to the where clause 
related to defect 00309263.0PR15Q4 closed vmromanos Price list version defined for España organization not available when registering product for * organization 
Attached Filespng pl1.png (112,491) 2015-09-02 10:54
https://issues.openbravo.com/file_download.php?file_id=8412&type=bug
png

png pl2.png (107,724) 2015-09-02 10:54
https://issues.openbravo.com/file_download.php?file_id=8413&type=bug
png

png roleOrgAccess.png (121,426) 2015-09-02 10:54
https://issues.openbravo.com/file_download.php?file_id=8414&type=bug
png

png roleUser.png (122,574) 2015-09-02 10:54
https://issues.openbravo.com/file_download.php?file_id=8415&type=bug
png
Issue History
Date ModifiedUsernameFieldChange
2015-09-02 10:50malsasuaNew Issue
2015-09-02 10:50malsasuaAssigned To => Triage Finance
2015-09-02 10:50malsasuaModules => Core
2015-09-02 10:50malsasuaResolution time => 1442700000
2015-09-02 10:50malsasuaTriggers an Emergency Pack => No
2015-09-02 10:54malsasuaFile Added: pl1.png
2015-09-02 10:54malsasuaFile Added: pl2.png
2015-09-02 10:54malsasuaFile Added: roleOrgAccess.png
2015-09-02 10:54malsasuaFile Added: roleUser.png
2015-09-04 10:22vmromanosRelationship addedrelated to 0021821
2015-09-04 12:36vmromanosNote Added: 0080107
2015-09-04 12:37vmromanosNote Edited: 0080107bug_revision_view_page.php?bugnote_id=0080107#r9357
2015-09-07 09:14AtulOpenbravoAssigned ToTriage Finance => AtulOpenbravo
2015-09-07 09:14AtulOpenbravoStatusnew => scheduled
2015-09-08 08:52AtulOpenbravoNote Added: 0080236
2015-09-08 11:42vmromanosNote Edited: 0080107bug_revision_view_page.php?bugnote_id=0080107#r9379
2015-09-08 12:32vmromanosNote Added: 0080243
2015-09-08 13:52vmromanosNote Edited: 0080243bug_revision_view_page.php?bugnote_id=0080243#r9390
2015-09-08 16:52vmromanosRelationship addedrelated to 0030797
2015-09-08 16:56vmromanosNote Edited: 0080243bug_revision_view_page.php?bugnote_id=0080243#r9393
2015-09-09 11:20hgbotCheckin
2015-09-09 11:20hgbotNote Added: 0080273
2015-09-09 11:20hgbotStatusscheduled => resolved
2015-09-09 11:20hgbotResolutionopen => fixed
2015-09-09 11:20hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/33b4685cb8aee0a367b42741ecaf207c5b602597 [^]
2015-09-09 11:20hgbotCheckin
2015-09-09 11:20hgbotNote Added: 0080274
2015-09-09 11:20hgbotFixed in SCM revisionhttp://code.openbravo.com/erp/devel/pi/rev/33b4685cb8aee0a367b42741ecaf207c5b602597 [^] => http://code.openbravo.com/erp/devel/pi/rev/7d592e7f797fadd672708877241eda75ec953cdf [^]
2015-09-09 11:21vmromanosReview Assigned To => vmromanos
2015-09-09 11:21vmromanosNote Added: 0080275
2015-09-09 11:21vmromanosStatusresolved => closed
2015-09-09 23:11hudsonbotCheckin
2015-09-09 23:11hudsonbotNote Added: 0080298
2015-09-09 23:11hudsonbotCheckin
2015-09-09 23:11hudsonbotNote Added: 0080299
2015-09-10 09:51vmromanosNote Edited: 0080107bug_revision_view_page.php?bugnote_id=0080107#r9412
2015-09-10 10:02vmromanosNote Added: 0080310
2015-09-10 10:02vmromanosStatusclosed => new
2015-09-10 10:02vmromanosResolutionfixed => open
2015-09-10 11:43hgbotCheckin
2015-09-10 11:43hgbotNote Added: 0080313
2015-09-10 11:43hgbotStatusnew => resolved
2015-09-10 11:43hgbotResolutionopen => fixed
2015-09-10 11:43hgbotFixed in SCM revisionhttp://code.openbravo.com/erp/devel/pi/rev/7d592e7f797fadd672708877241eda75ec953cdf [^] => http://code.openbravo.com/erp/devel/pi/rev/13211c4cc0a0029cb8643259cfbe3bd1e2ed215b [^]
2015-09-10 11:44vmromanosStatusresolved => closed
2015-09-11 06:33hudsonbotCheckin
2015-09-11 06:33hudsonbotNote Added: 0080324
2015-09-25 08:50vmromanosRelationship addedrelated to 0030926

Notes
(0080107)
vmromanos   
2015-09-04 12:36   
(edited on: 2015-09-10 09:51)
Proposed solution:
1. Implement a validation rule in the M_PriceList_Version_ID column to see the records belonging the authorized orgs depending on the context role. (You can take as an example 'AD_Org of logged Role' validation rule)
Please verify that this new validation rule works fine for all the fields (in different windows) linked to this column.
2. Set this callout as deprecated (we don't delete it to avoid an API change)
(0080236)
AtulOpenbravo   
2015-09-08 08:52   
Test Plan
- Login as F&B International Group Admin.
- Create pricelist as attachment: pl1.png
- Create pricelist as attachment: pl2.png
- Create role as attachment: roleOrgAccess.png and roleUser.png
- Logout and login using the role "regionNorte"
- Go to window product -> tab pricelist
- Open the pricelist selector list, check that not all pricelist are displayed, but only displayed is regionNorte - plv.
(0080243)
vmromanos   
2015-09-08 12:32   
(edited on: 2015-09-08 16:56)
Test plan II:
Create a role with access to Norte and Sur organizations similar to the previous one.
Go to Product | Price
Create a new record for Agua sin Gas 1L
Verify you can select either Norte or Sur price list versions created before

Please note that if the role is defined with User Level = "Organization", this scenario is not working fine. It will be automatically fixed with 0030797
(0080273)
hgbot   
2015-09-09 11:20   
Repository: erp/devel/pi
Changeset: 33b4685cb8aee0a367b42741ecaf207c5b602597
Author: Atul Gaware <atul.gaware <at> openbravo.com>
Date: Tue Sep 08 10:27:21 2015 +0530
URL: http://code.openbravo.com/erp/devel/pi/rev/33b4685cb8aee0a367b42741ecaf207c5b602597 [^]

Fixes Issue 30735:All price lists are displayed without organization role
access check.

Validation is provided to check the organization of price list being loaded
is accessible by Role of logged in user. SL_ProductPrice_PriceListVersion
is deprecated as is not required and also unlinked from the column.

---
M src-db/database/sourcedata/AD_COLUMN.xml
M src-db/database/sourcedata/AD_VAL_RULE.xml
M src/org/openbravo/erpCommon/ad_callouts/SL_ProductPrice_PriceListVersion.java
---
(0080274)
hgbot   
2015-09-09 11:20   
Repository: erp/devel/pi
Changeset: 7d592e7f797fadd672708877241eda75ec953cdf
Author: Víctor Martínez Romanos <victor.martinez <at> openbravo.com>
Date: Tue Sep 08 19:05:27 2015 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/7d592e7f797fadd672708877241eda75ec953cdf [^]

Fixed bug 30735: code review improvements

Rewritten validation rule to be generic, so we can use it for any record (not only Price List Versions).
In case the role's user level is Client or Client+Organization, the validation also displays PLV for * organization even in the case the * organization is not in the list of the Role's Organizations. This is the way it works for normal WAD windows (like Price List).
Removed code related to user level = System, as this is not used by the finance flows

---
M src-db/database/sourcedata/AD_VAL_RULE.xml
---
(0080275)
vmromanos   
2015-09-09 11:21   
Code review + testing OK
(0080298)
hudsonbot   
2015-09-09 23:11   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/35a1eec70785 [^]
Maturity status: Test
(0080299)
hudsonbot   
2015-09-09 23:11   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/35a1eec70785 [^]
Maturity status: Test
(0080310)
vmromanos   
2015-09-10 10:02   
Reopened:

The callout might have sense in same scenarios with complex organization setup. It ensures the organization of the new Product Price is the same as the Price List Version if the role has write access to it.

Besides we will fix the following line as the indexOf() may return 0 when the record is found:
hasAccessTo = role.getOrganizationList().indexOf(plv.getOrganization().getId()) > 0;
(0080313)
hgbot   
2015-09-10 11:43   
Repository: erp/devel/pi
Changeset: 13211c4cc0a0029cb8643259cfbe3bd1e2ed215b
Author: Víctor Martínez Romanos <victor.martinez <at> openbravo.com>
Date: Thu Sep 10 11:39:20 2015 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/13211c4cc0a0029cb8643259cfbe3bd1e2ed215b [^]

Fixed bug 30735: SL_ProductPrice_PriceListVersion is back with improvements

The SL_ProductPrice_PriceListVersion callout has been associated again to the Price List Version column.
This callout sets the Product Price's Organization equal to the Price List Version's Organization only in the case the current role has write access to the PLV's Organization.

Besides, this callout has been improved:
+ Run in admin mode
+ The validation to know whether it was a valid organization was wrong, because the indexOf() may also return 0 when a record is found. Besides using indexOf() to run this validation could be wrong when the Price List version is defined for * organization (since any of the organization's UUID in the role might contain a 0).
So this validation has been completely rewritten using StringTokenizer.
+ Finally, in case the role is defined for Client or Client+Organization user level, we force to include * in the list of valid organizations.

---
M src-db/database/sourcedata/AD_COLUMN.xml
M src/org/openbravo/erpCommon/ad_callouts/SL_ProductPrice_PriceListVersion.java
---
(0080324)
hudsonbot   
2015-09-11 06:33   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/2828f6cbe752 [^]
Maturity status: Test