Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0034931Openbravo ERPA. Platformpublic2017-01-12 17:052022-02-01 08:08
ReporterJONHM 
Assigned ToTriage Platform Base 
PriorityhighSeveritymajorReproducibilityalways
StatusacknowledgedResolutionopen 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customerOBPS
Web browser
ModulesCore
Support ticket44646
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0034931: Using both WS types return different information for the same user
DescriptionWhen granting some window access to a role (which it suppose to only have permission to view the related tables of that window), it shows different data in both Web Services. It shows more properties to related Entities using JSon web service than using DAL Web Service.
Notice that flows of both WS types (DAL and JSon) are different.
Steps To Reproduce1) Create Role "test" in [Role] window:
    name: test
    user level: Client+Organization
    - check "manual" checkbox on and also check on the "Is Web Service Enabled" checkbox
    -- Then Switch to "Org Access" tab and give access to '*' and finally switch to "Window Access" tab and give access to window "Warehouse and Storage Bins"

2) Create User "test" in [User] window:
    name: test
    username: test
    password: openbravo
    - Then switch to "User Roles" tab and add the previous created role "test".

3) Using some chrome tool, like 'Postman' to check web services, introduce the URL to check if our user have access to 'Orders' or 'Country' (notice that we tried the issue into Openbravo livebuilds, when trying on a localhost environment it should be replaced by http://localhost:8080/openbravo/ws/dal/... [^]):


3.1) First, let's try the JSon WS:
https://livebuilds.openbravo.com/erp_pi_pgsql/org.openbravo.service.json.jsonrest/Order [^]
--> Notice that several fields are displayed, like partnerAddress, userContact and more info.

3.2) Then, try it on DAL WS:
https://livebuilds.openbravo.com/erp_pi_pgsql/ws/dal/Order [^]
--> Notice that only three fields are displayed (documentNo, orderDate, grandTotalAmount)
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
Attached Filespng Screenshot from 2017-01-12 17-28-10.png (146,133) 2017-01-12 17:28
https://issues.openbravo.com/file_download.php?file_id=10292&type=bug
png
Issue History
Date ModifiedUsernameFieldChange
2017-01-12 17:05JONHMNew Issue
2017-01-12 17:05JONHMAssigned To => platform
2017-01-12 17:05JONHMOBNetwork customer => Yes
2017-01-12 17:05JONHMModules => Core
2017-01-12 17:05JONHMSupport ticket => 44646
2017-01-12 17:05JONHMTriggers an Emergency Pack => No
2017-01-12 17:07JONHMNote Added: 0093433
2017-01-12 17:25JONHMSummaryExtra granted access to Entities using JSon Web Service => Using both WS types return different information for the same user
2017-01-12 17:25JONHMDescription Updatedbug_revision_view_page.php?rev_id=14257#r14257
2017-01-12 17:25JONHMSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=14259#r14259
2017-01-12 17:28JONHMFile Added: Screenshot from 2017-01-12 17-28-10.png
2017-06-02 10:52alostaleStatusnew => acknowledged
2022-02-01 08:08alostaleAssigned Toplatform => Triage Platform Base

Notes
(0093433)
JONHM   
2017-01-12 17:07   
- WS DAL: The data is parsed by the EntityXMLConverter class and only takes into account if the entity is derived readable to return only id and identifier.

- WS JSON: The data is parse by the DataToJSONConverter class and takes into account if the entity is derived readable or whether the property is allowDerivedRead.