Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0032728Openbravo ERPC. Securitypublic2016-04-20 13:502016-06-17 19:37
Reporterinigosanchez 
Assigned Toinigosanchez 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version3.0PR16Q3Fixed in Version3.0PR16Q3 
Merge Request Status
Review Assigned Toalostale
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0032728: Standard datasources should check entity access.
DescriptionStandard datasources should check entity access.
Steps To Reproduce-
Proposed Solution* Allows implement entity access check.
* This mechanism should be overwritable so specific cases can implement their own security mechanisms.
* Define a property for backwards compatibility to allow them
Additional Information
TagsNo tags attached.
Relationships
related to defect 00327533.0PR16Q3 closed inigosanchez Openbravo ERP API change because weld injection is being used in BaseDataSourceService 
related to defect 0032820 closed inigosanchez Openbravo ERP Cleanup unused TestInitializeAccess test 
related to defect 0032819 closed inigosanchez Openbravo ERP An error is thrown when a Query List Widget is fetched. 
related to defect 00327303.0PR16Q3 closed inigosanchez Openbravo ERP API change because some methods have been added. 
related to defect 0032178 closed inigosanchez Openbravo ERP AccessTableNoView error is thrown when it shouldnt be thrown. 
related to defect 0033866 closed jorge-garcia Retail Modules [Mobile Warehouse Operations] Mobile Warehouse Operations 1.0.10 should depend on Mobile Core Infrastructure 3.0RR16Q3 
related to defect 0034499 closed caristu Openbravo ERP [clustering] CachedPreference feature is not supported on clustered environments 
related to defect 0034823 closed inigosanchez Openbravo ERP Can't add lines in Requisition with role F&B España, S.A - Employee 
related to defect 0037200 acknowledged Triage Platform Base Openbravo ERP Entity Check is not done for the datasource calls of the foreign key filters in tree view 
causes defect 00327953.0PR16Q3 closed inigosanchez Openbravo ERP G/L Item combo appears empty in Add Payment process definition 
causes defect 0032833 closed inigosanchez Openbravo ERP Tree view is not working properly 
causes defect 00331943.0PR16Q3 closed alostale Openbravo ERP Access not granted to Multi Selector Entity 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2016-04-20 13:50inigosanchezNew Issue
2016-04-20 13:50inigosanchezAssigned To => inigosanchez
2016-04-20 13:50inigosanchezModules => Core
2016-04-20 13:50inigosanchezTriggers an Emergency Pack => No
2016-04-20 13:50inigosanchezStatusnew => scheduled
2016-04-20 14:52inigosanchezRelationship addedrelated to 0032730
2016-04-21 13:36inigosanchezRelationship addedrelated to 0032753
2016-04-22 12:26hgbotCheckin
2016-04-22 12:26hgbotNote Added: 0085885
2016-04-22 12:27hgbotCheckin
2016-04-22 12:27hgbotNote Added: 0085886
2016-04-22 12:27hgbotCheckin
2016-04-22 12:27hgbotNote Added: 0085887
2016-04-22 17:29hgbotCheckin
2016-04-22 17:29hgbotNote Added: 0085910
2016-04-22 17:29hgbotCheckin
2016-04-22 17:29hgbotNote Added: 0085911
2016-04-22 17:30hgbotCheckin
2016-04-22 17:30hgbotNote Added: 0085912
2016-04-25 09:32hgbotCheckin
2016-04-25 09:32hgbotNote Added: 0085939
2016-04-25 09:43hgbotCheckin
2016-04-25 09:43hgbotNote Added: 0085942
2016-04-25 09:43hgbotStatusscheduled => resolved
2016-04-25 09:43hgbotResolutionopen => fixed
2016-04-25 09:43hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/daf66237fa614b8fd8e72b08b17bcd893ed5e264 [^]
2016-04-25 09:44hgbotCheckin
2016-04-25 09:44hgbotNote Added: 0085943
2016-04-25 09:44hgbotCheckin
2016-04-25 09:44hgbotNote Added: 0085944
2016-04-25 09:45hgbotCheckin
2016-04-25 09:45hgbotNote Added: 0085945
2016-04-25 09:45hgbotCheckin
2016-04-25 09:45hgbotNote Added: 0085946
2016-04-25 09:46hgbotCheckin
2016-04-25 09:46hgbotNote Added: 0085947
2016-04-25 09:47hgbotCheckin
2016-04-25 09:47hgbotNote Added: 0085948
2016-04-25 09:51inigosanchezReview Assigned To => alostale
2016-04-25 10:26hgbotCheckin
2016-04-25 10:26hgbotNote Added: 0085952
2016-04-25 13:59hgbotCheckin
2016-04-25 13:59hgbotNote Added: 0085960
2016-04-27 10:40alostaleRelationship addedcauses 0032795
2016-04-29 14:11alostaleNote Added: 0086082
2016-04-29 14:11alostaleStatusresolved => closed
2016-04-29 14:11alostaleFixed in Version => 3.0PR16Q3
2016-05-01 23:28inigosanchezRelationship addedrelated to 0032820
2016-05-01 23:29inigosanchezRelationship addedrelated to 0032819
2016-05-03 10:02alostaleRelationship addedcauses 0032833
2016-05-09 08:26inigosanchezRelationship addedrelated to 0032178
2016-06-09 10:17alostaleRelationship addedrelated to 0033194
2016-06-09 10:25alostaleRelationship replacedcauses 0033194
2016-06-17 19:37hudsonbotCheckin
2016-06-17 19:37hudsonbotNote Added: 0087489
2016-08-31 14:19ngarciaRelationship addedrelated to 0033866
2016-11-14 17:10caristuRelationship addedrelated to 0034499
2016-12-29 15:13inigosanchezRelationship addedrelated to 0034823
2017-10-31 13:46caristuRelationship addedrelated to 0037200

Notes
(0085885)
hgbot   
2016-04-22 12:26   
Repository: erp/pmods/org.openbravo.mobile.warehouse.physicalinventory
Changeset: 2c01d09d4265de62e04f80c1f0e92ebee71dba0a
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 13:03:54 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse.physicalinventory/rev/2c01d09d4265de62e04f80c1f0e92ebee71dba0a [^]

Related with issue 32728: Some mobile services have been removed.

It have been updated some mobile services because now it is used
'org.openbravo.service.datasource/1626FF659E0A40DAA220C00141D5BD71'
mobile service (new mobile service) to manage new check entity access.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
---
(0085886)
hgbot   
2016-04-22 12:27   
Repository: erp/pmods/org.openbravo.mobile.warehouse.picking
Changeset: 77fc452aaf453cbba92106eb14afb9a0850c8087
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 13:02:03 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse.picking/rev/77fc452aaf453cbba92106eb14afb9a0850c8087 [^]

Related with issue 32728: Some mobile services have been updated.

It have been updated some mobile services because now it is used
'org.openbravo.service.datasource/1626FF659E0A40DAA220C00141D5BD71'
mobile service (new mobile service) to manage new check entity access.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
---
(0085887)
hgbot   
2016-04-22 12:27   
Repository: erp/pmods/org.openbravo.mobile.warehouse
Changeset: b6a9dc0b446829963b4c11e07d23d7817be54e8e
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 13:00:26 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse/rev/b6a9dc0b446829963b4c11e07d23d7817be54e8e [^]

Related with issue 32728: Some mobile services have been updated.

It have been updated some mobile services because now it is used
'org.openbravo.service.datasource/1626FF659E0A40DAA220C00141D5BD71'
mobile service (new mobile service) to manage new check entity access.

Besides 'WarehouseMovementBinDatasource' extends from 'MobileDataSourceService'
to take into account check entity access in standard DS invoked from mobile.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
M src/org/openbravo/mobile/warehouse/datasource/WarehouseMovementBinDatasource.java
---
(0085910)
hgbot   
2016-04-22 17:29   
Repository: erp/pmods/org.openbravo.mobile.warehouse
Changeset: 1581f18e0b49f430e7804b21841a7b4f9f0ae152
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Fri Apr 22 17:28:43 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse/rev/1581f18e0b49f430e7804b21841a7b4f9f0ae152 [^]

Related with issue 32728: Backout changeset b6a9dc0b4468

Backed out changeset b6a9dc0b4468 because retail integration fails.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
M src/org/openbravo/mobile/warehouse/datasource/WarehouseMovementBinDatasource.java
---
(0085911)
hgbot   
2016-04-22 17:29   
Repository: erp/pmods/org.openbravo.mobile.warehouse.physicalinventory
Changeset: 82a289d7b17856befc5655697a1a7dc8a28ecf49
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Fri Apr 22 17:25:40 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse.physicalinventory/rev/82a289d7b17856befc5655697a1a7dc8a28ecf49 [^]

Related with issue 32728: Backout changeset 2c01d09d4265

Backed out changeset 2c01d09d4265 because retail integration fails.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
---
(0085912)
hgbot   
2016-04-22 17:30   
Repository: erp/pmods/org.openbravo.mobile.warehouse.picking
Changeset: eeeb1f3bfa5f9f3621720972ce3f768c13c5228b
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Fri Apr 22 17:23:10 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse.picking/rev/eeeb1f3bfa5f9f3621720972ce3f768c13c5228b [^]

Related with issue 32728: Backout changeset 77fc452aaf45

Backed out changeset 77fc452aaf45 because retail integration fails.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
---
(0085939)
hgbot   
2016-04-25 09:32   
Repository: erp/devel/api-checks
Changeset: 89ae22f80a61d51fbf6c7335b6838cb54f364546
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Fri Apr 22 11:11:47 2016 +0200
URL: http://code.openbravo.com/erp/devel/api-checks/rev/89ae22f80a61d51fbf6c7335b6838cb54f364546 [^]

Fixes issue 32730: API change for issue 32728

---
M java.japi.gz
---
(0085942)
hgbot   
2016-04-25 09:43   
Repository: erp/devel/pi
Changeset: daf66237fa614b8fd8e72b08b17bcd893ed5e264
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Fri Apr 22 10:01:49 2016 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/daf66237fa614b8fd8e72b08b17bcd893ed5e264 [^]

Fixed issue 32728: Standard datasources should check entity access.

---
M .settings/org.eclipse.jdt.core.prefs
M modules/org.openbravo.client.application/src/org/openbravo/client/application/ADAlertDatasourceService.java
M modules/org.openbravo.client.application/src/org/openbravo/client/application/CachedPreference.java
M modules/org.openbravo.client.querylist/src/org/openbravo/client/querylist/QueryListDataSource.java
M modules/org.openbravo.service.datasource/src-db/database/sourcedata/AD_REF_LIST.xml
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/BaseDataSourceService.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/ComboTableDatasourceService.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DataSourceConstants.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DataSourceService.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DataSourceServlet.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DefaultDataSourceService.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/HQLDataSourceService.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/NoteDataSource.java
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/TreeDatasourceService.java
M modules/org.openbravo.userinterface.selector/src/org/openbravo/userinterface/selector/CustomQuerySelectorDatasource.java
M modules/org.openbravo.userinterface.selector/src/org/openbravo/userinterface/selector/SelectorFieldPropertyDataSource.java
M src-test/src/org/openbravo/test/AllWebserviceTests.java
M src-test/src/org/openbravo/test/datasource/DataSourceWhereParameter.java
M src-test/src/org/openbravo/test/datasource/ProductSelectorDataSourceTest.java
M src-test/src/org/openbravo/test/datasource/TestAllowUnpagedDatasourcePreference.java
M src-test/src/org/openbravo/test/datasource/TestComboDatasource.java
M src-test/src/org/openbravo/test/security/ExplicitCrossOrganizationReference.java
M src/org/openbravo/base/model/ModelProvider.java
M src/org/openbravo/common/datasource/StockReservationPickAndEditDataSource.java
M src/org/openbravo/dal/security/EntityAccessChecker.java
M src/org/openbravo/materialmgmt/ManageVariantsDS.java
M src/org/openbravo/materialmgmt/ProductCharacteristicsDS.java
A src-test/src/org/openbravo/test/datasource/DataSourceSecurity.java
A src-test/src/org/openbravo/test/datasource/TestInitializeAccess.java
---
(0085943)
hgbot   
2016-04-25 09:44   
Repository: erp/pmods/org.openbravo.mobile.core
Changeset: 2eeffcabe702aef1acb9e7a965936d9b722f2396
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Wed Apr 20 14:28:17 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/rev/2eeffcabe702aef1acb9e7a965936d9b722f2396 [^]

Related with issue 32728: MobileDataSourceService datasource has been created.

MobileDataSourceService has been created. Security methods of MobileDataSourceService
are temporarily disabled until this security will be implemented in mobile part. Besides,
It have been created two new mobile services:

   * From one side a new mobile service called 'org.openbravo.service.datasource'.
     This service name uses 'contains' to match it with the requests from the client.
     So a service name of 'org.openbravo.service.datasource' will handle all the
     client side requests with 'org.openbravo.service.datasource' in the requested
     URL. For this reason,mobile services that are previously deleted it can be
     manage properly.

   * On the other hand, It have been created new mobile service called
     'org.openbravo.mobile.core.datasource/MobileDataSourceService' to allows used this
     new DS in mobile.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
M web/org.openbravo.mobile.core/source/data/ob-model.js
A src-db/database/sourcedata/OBSERDS_DATASOURCE.xml
A src/org/openbravo/mobile/core/datasource/MobileDataSourceService.java
---
(0085944)
hgbot   
2016-04-25 09:44   
Repository: erp/pmods/org.openbravo.mobile.core
Changeset: 7c26697c6f6e28bdefc323eff51341c2c6653d99
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 13:11:26 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/rev/7c26697c6f6e28bdefc323eff51341c2c6653d99 [^]

Related with issue 32728: MobileDataSourceService datasource has been improved.

MobileDataSourceService has been updated. It have been added fetch, add, remove
and update methods. Besides, It have been updated two mobile services:

   * From one side a new mobile service called 'org.openbravo.service.datasource' has
     been removed.

   * On the other hand, It have been updated mobile service called
     'org.openbravo.mobile.core.datasource/MobileDataSourceService' to
     'org.openbravo.service.datasource/1626FF659E0A40DAA220C00141D5BD71' because
     this service name should be an url.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
M src/org/openbravo/mobile/core/datasource/MobileDataSourceService.java
---
(0085945)
hgbot   
2016-04-25 09:45   
Repository: erp/pmods/org.openbravo.mobile.warehouse.picking
Changeset: 80d240cb7798a54664c5c2acaa43191d1f67f086
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 13:02:03 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse.picking/rev/80d240cb7798a54664c5c2acaa43191d1f67f086 [^]

Related with issue 32728: Some mobile services have been updated.

It have been updated some mobile services because now it is used
'org.openbravo.service.datasource/1626FF659E0A40DAA220C00141D5BD71'
mobile service (new mobile service) to manage new check entity access.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
---
(0085946)
hgbot   
2016-04-25 09:45   
Repository: erp/pmods/org.openbravo.mobile.warehouse
Changeset: a2e2b97cec2904ccaff050c81bc48c19c33ae7d4
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 13:00:26 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse/rev/a2e2b97cec2904ccaff050c81bc48c19c33ae7d4 [^]

Related with issue 32728: Some mobile services have been updated.

It have been updated some mobile services because now it is used
'org.openbravo.service.datasource/1626FF659E0A40DAA220C00141D5BD71'
mobile service (new mobile service) to manage new check entity access.

Besides 'WarehouseMovementBinDatasource' extends from 'MobileDataSourceService'
to take into account check entity access in standard DS invoked from mobile.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
M src/org/openbravo/mobile/warehouse/datasource/WarehouseMovementBinDatasource.java
---
(0085947)
hgbot   
2016-04-25 09:46   
Repository: erp/pmods/org.openbravo.mobile.warehouse.physicalinventory
Changeset: ef87d185055f3cd20275a746ea82c873ba3b091b
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 13:03:54 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.warehouse.physicalinventory/rev/ef87d185055f3cd20275a746ea82c873ba3b091b [^]

Related with issue 32728: Some mobile services have been updated.

It have been updated some mobile services because now it is used
'org.openbravo.service.datasource/1626FF659E0A40DAA220C00141D5BD71'
mobile service (new mobile service) to manage new check entity access.

---
M src-db/database/sourcedata/OBMOBC_SERVICES.xml
---
(0085948)
hgbot   
2016-04-25 09:47   
Repository: erp/pmods/org.openbravo.module.resources
Changeset: 0df0e74fec7ca9375d979f10f9dbbc905086fec8
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Thu Apr 21 14:15:33 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.module.resources/rev/0df0e74fec7ca9375d979f10f9dbbc905086fec8 [^]

Related with issue 32728: ResourcesCalendarDataSource has been updated.

ResourcesCalendarDataSource datasource has been updated to take into account new
security methods.

---
M src/org/openbravo/module/resources/calendar/ResourcesCalendarDataSource.java
---
(0085952)
hgbot   
2016-04-25 10:26   
Repository: erp/pmods/org.openbravo.mobile.core
Changeset: 6ccdb26762c805fedbeadebd59ef6e63c18df1fa
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Mon Apr 25 10:24:55 2016 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/rev/6ccdb26762c805fedbeadebd59ef6e63c18df1fa [^]

Related with issue 32728: Updated license text to OBCL license text.

---
M src/org/openbravo/mobile/core/datasource/MobileDataSourceService.java
---
(0085960)
hgbot   
2016-04-25 13:59   
Repository: erp/devel/api-checks
Changeset: b8d18c0ffbb8b46bcc8eba1fb97e0211dd177a1d
Author: Inigo Sanchez <inigo.sanchez <at> openbravo.com>
Date: Mon Apr 25 13:56:37 2016 +0200
URL: http://code.openbravo.com/erp/devel/api-checks/rev/b8d18c0ffbb8b46bcc8eba1fb97e0211dd177a1d [^]

Related with issue 32728: Wrong place for japi file.

---
M java/reference/java.japi.gz
R java.japi.gz
---
(0086082)
alostale   
2016-04-29 14:11   
code reviewed and tested as part of the project
(0087489)
hudsonbot   
2016-06-17 19:37   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/0dc7be081b1c [^]
Maturity status: Test