Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0033166Openbravo ERP01. General setuppublic2016-06-06 18:132017-02-01 15:41
Reporterngarcia 
Assigned Toalostale 
PriorityurgentSeveritymajorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version3.0PR16Q3 
Merge Request Status
Review Assigned Tocaristu
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0033166: Role with access to one organization can edit all of them in Organization window
DescriptionRole with access to one organization can edit all of them in Organization window
Steps To ReproduceAs group admin role:
   Create a new Role:
      User Level: Client+Organization
      Advanced: Y
   Remove all the organizations except F&B España - Región Norte
   Add the role to Openbravo User
   Log out and log in with previously created role
   Go to Organization window and observe you can edit all the organizations
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
related to defect 0033255 closed alostale some organizations not shown in tree view 
related to defect 0033198 closed dmiguelez Wrong Organization in treenode 
related to defect 00333553.0PR16Q4 closed caristu Potential security issue in Process Definitions 
related to defect 0040303 closed jarmendariz System allows to show all the organizations to the user who has access to only single organization 
causes defect 0034977 closed inigosanchez A deactivated organization can not be activated again. 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2016-06-06 18:13ngarciaNew Issue
2016-06-06 18:13ngarciaAssigned To => Triage Finance
2016-06-06 18:13ngarciaModules => Core
2016-06-06 18:13ngarciaResolution time => 1466978400
2016-06-06 18:13ngarciaTriggers an Emergency Pack => No
2016-06-06 18:14ngarciaIssue Monitored: networkb
2016-06-06 18:57aferrazAssigned ToTriage Finance => platform
2016-06-14 10:27alostaleIssue cloned0033255
2016-06-14 10:27alostaleRelationship addedrelated to 0033255
2016-06-14 10:28alostaleSummaryRole with access to one organization can edit all of them in Organization window, some of them not shown in tree view => Role with access to one organization can edit all of them in Organization window
2016-06-14 10:28alostaleDescription Updatedbug_revision_view_page.php?rev_id=12360#r12360
2016-06-14 10:28alostaleSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=12362#r12362
2016-06-14 10:29alostaleNote Added: 0087235
2016-06-14 10:30alostaleRelationship addedrelated to 0033198
2016-06-15 09:02alostaleReview Assigned To => caristu
2016-06-15 09:07hgbotCheckin
2016-06-15 09:07hgbotNote Added: 0087281
2016-06-15 09:07hgbotCheckin
2016-06-15 09:07hgbotNote Added: 0087282
2016-06-15 09:07hgbotStatusnew => resolved
2016-06-15 09:07hgbotResolutionopen => fixed
2016-06-15 09:07hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/463564b77a032485223cc070cf0aa66f6f0e03d8 [^]
2016-06-17 10:14caristuNote Added: 0087382
2016-06-17 10:14caristuStatusresolved => closed
2016-06-17 10:14caristuFixed in Version => 3.0PR16Q3
2016-06-17 19:38hudsonbotCheckin
2016-06-17 19:38hudsonbotNote Added: 0087618
2016-06-17 19:38hudsonbotCheckin
2016-06-17 19:38hudsonbotNote Added: 0087619
2016-06-27 09:25caristuRelationship addedrelated to 0033355
2017-01-25 08:37caristuRelationship addedcauses 0034977
2017-02-01 15:41alostaleAssigned Toplatform => alostale
2019-03-11 13:26jarmendarizRelationship addedrelated to 0040303

Notes
(0087235)
alostale   
2016-06-14 10:29   
Originally, 2 issues were reported in this one, 0033255 has been created to split it.
(0087281)
hgbot   
2016-06-15 09:07   
Repository: erp/devel/pi
Changeset: ac14fb7ab6ef4aa3bddb9e0b6907eafa4d3b1eeb
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Wed Jun 15 08:39:05 2016 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/ac14fb7ab6ef4aa3bddb9e0b6907eafa4d3b1eeb [^]

related to bug 33166: writable access is not checked when editing client/org

  Code clean up: consolidated 3 implementations of checkWritable in one:
   - SecurityChecker.checkWriteAccess duplicated code in SecurityChecker.isWritable
     with the only difference of returning a boolean instead of throwing an
     exception. Now isWritable invokes checkWriteAccess.
   - FIC implemented again this check to make the UI readonly for non writable
     rows, now it invokes SecurityChecker.isWritable method.

---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/window/FormInitializationComponent.java
M src/org/openbravo/dal/security/SecurityChecker.java
---
(0087282)
hgbot   
2016-06-15 09:07   
Repository: erp/devel/pi
Changeset: 463564b77a032485223cc070cf0aa66f6f0e03d8
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Wed Jun 15 09:06:46 2016 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/463564b77a032485223cc070cf0aa66f6f0e03d8 [^]

fixed bug 33166: writable access is not checked when editing client/org

  A role without access to organization A could edit it in Organization window.

  Writable access was bypassed in this case both in UI and DAL.

  This patch includes two fixes:
   - DAL (SecurityChecker) treats instances of Client and Organization objects
     as special cases getting the client or organization ids not from FK property
     but directly as their id. In this manner checking for those entities is
     performed.
   - Grid UI. Similar implementation is done to decide whether a row should be
     marked as ready only. In this case it is not possible to reuse previous code
     as the checks are done on a json object instead of on a DAL object.

---
M modules/org.openbravo.service.json/src/org/openbravo/service/json/DefaultJsonDataService.java
M src/org/openbravo/dal/security/SecurityChecker.java
---
(0087382)
caristu   
2016-06-17 10:14   
Code review + testing OK

Verified in pi@a3288a6ce595
(0087618)
hudsonbot   
2016-06-17 19:38   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/0dc7be081b1c [^]
Maturity status: Test
(0087619)
hudsonbot   
2016-06-17 19:38   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/0dc7be081b1c [^]
Maturity status: Test