Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0033194Openbravo ERPA. Platformpublic2016-06-08 14:432016-06-17 19:38
Reporteraferraz 
Assigned Toalostale 
PriorityurgentSeveritymajorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS30OS VersionProfessional Appliance
Product Version 
Target Version3.0PR16Q3Fixed in Version3.0PR16Q3 
Merge Request Status
Review Assigned Toinigosanchez
OBNetwork customerNo
Web browser
ModulesCore
Support ticket42162
Regression levelPre packaging ( pi )
Regression date2016-04-22
Regression introduced in releasepi
Regression introduced by commithttps://code.openbravo.com/erp/devel/pi/rev/daf66237fa614b8fd8e72b08b17bcd893ed5e264 [^]
Triggers an Emergency PackNo
Summary0033194: Access not granted to Multi Selector Entity
DescriptionAccess not granted to Multi Selector Entity
Steps To ReproduceAs System Admin:
- Create a new Reference child of OBUISEL_Multi Selector Reference reference.
- Add a defined selector with ADTablePostV table.
- Create a new Process Definition.
- Add a parameter with created reference.

As F&B Admin:
- Access to created process definition
- Open the multi selector
- Realize the following error is shown:
Entity ADTablePostV is not accessible by this role/user: F&B International Group Admin/Openbravo
Proposed SolutionAttached possible solution
Additional Information
TagsNo tags attached.
Relationships
caused by feature request 00327283.0PR16Q3 closed inigosanchez Standard datasources should check entity access. 
blocks defect 00330633.0PR16Q3 closed markmm82 It should be possible to run "Reset Accounting" process for several organization at once 
Attached Filesdiff 33194.diff (1,730) 2016-06-08 14:46
https://issues.openbravo.com/file_download.php?file_id=9505&type=bug
Issue History
Date ModifiedUsernameFieldChange
2016-06-08 14:43aferrazNew Issue
2016-06-08 14:43aferrazAssigned To => platform
2016-06-08 14:43aferrazOBNetwork customer => No
2016-06-08 14:43aferrazModules => Core
2016-06-08 14:43aferrazTriggers an Emergency Pack => No
2016-06-08 14:44aferrazSupport ticket => 42162
2016-06-08 14:44aferrazResolution time => 1465509600
2016-06-08 14:44aferrazRelationship addedblocks 0033063
2016-06-08 14:46aferrazProposed Solution updated
2016-06-08 14:46aferrazFile Added: 33194.diff
2016-06-09 10:17alostaleRelationship addedrelated to 0032728
2016-06-09 10:22alostaleAssigned Toplatform => alostale
2016-06-09 10:23alostaleReview Assigned To => inigosanchez
2016-06-09 10:25alostaleRegression level => Pre packaging ( pi )
2016-06-09 10:25alostaleRegression date => 2016-04-22
2016-06-09 10:25alostaleRegression introduced in release => pi
2016-06-09 10:25alostaleRegression introduced by commit => https://code.openbravo.com/erp/devel/pi/rev/daf66237fa614b8fd8e72b08b17bcd893ed5e264 [^]
2016-06-09 10:25alostaleRelationship replacedcaused by 0032728
2016-06-09 10:29hgbotCheckin
2016-06-09 10:29hgbotNote Added: 0087110
2016-06-09 10:29hgbotStatusnew => resolved
2016-06-09 10:29hgbotResolutionopen => fixed
2016-06-09 10:29hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/7c7933ca1dca65cc09c5f9c790b78c45484d286f [^]
2016-06-10 12:44inigosanchezNote Added: 0087152
2016-06-10 12:44inigosanchezStatusresolved => closed
2016-06-10 12:44inigosanchezFixed in Version => 3.0PR16Q3
2016-06-17 19:38hudsonbotCheckin
2016-06-17 19:38hudsonbotNote Added: 0087598

Notes
(0087110)
hgbot   
2016-06-09 10:29   
Repository: erp/devel/pi
Changeset: 7c7933ca1dca65cc09c5f9c790b78c45484d286f
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Thu Jun 09 10:27:43 2016 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/7c7933ca1dca65cc09c5f9c790b78c45484d286f [^]

fixed bug 33194: Access not granted to Multiple Selector

  When a mulitple selector was added to a proccess definition, access to its
  enttity was not automatically granted, causing potential data request denial.

  Now multiple selector reference is taken into account to grant privileges when
  included in a process definition.

---
M src/org/openbravo/dal/security/EntityAccessChecker.java
---
(0087152)
inigosanchez   
2016-06-10 12:44   
Code reviewed in pi@f517e8c6bf44
(0087598)
hudsonbot   
2016-06-17 19:38   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/0dc7be081b1c [^]
Maturity status: Test