Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0038137Openbravo ERPA. Platformpublic2018-03-14 13:132018-03-16 09:00
Reportershuehner 
Assigned Toshuehner 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version3.0PR18Q2 
Merge Request Status
Review Assigned Toalostale
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0038137: EntityAccessChecker.initialize is not using bind-variables
DescriptionThis code is not using bind-variables:

      final String tafQryStr = "select ta from " + TableAccess.class.getName()
          + " ta where role.id='" + getRoleId() + "'";
      @SuppressWarnings("unchecked")
      final List<TableAccess> tas = SessionHandler.getInstance().createQuery(tafQryStr).list();

      // and take into account explicit process access
      final String processAccessQryStr = "select p.obuiappProcess.id from "
          + ProcessAccess.class.getName() + " p where p.role.id='" + getRoleId() + "'";
Steps To Reproduce-
Proposed Solution
Additional Information
TagsPerformance
Relationships
blocks design defect 0038136 acknowledged Triage Platform Base Tracking issue: Find & Fix queries not using bind-params but embedding values into query string 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2018-03-14 13:13shuehnerNew Issue
2018-03-14 13:13shuehnerAssigned To => platform
2018-03-14 13:13shuehnerModules => Core
2018-03-14 13:13shuehnerTriggers an Emergency Pack => No
2018-03-14 13:13shuehnerRelationship addedblocks 0038136
2018-03-14 16:46shuehnerAssigned Toplatform => shuehner
2018-03-14 17:27shuehnerDescription Updatedbug_revision_view_page.php?rev_id=16846#r16846
2018-03-15 17:27hgbotCheckin
2018-03-15 17:27hgbotNote Added: 0103287
2018-03-15 17:27hgbotStatusnew => resolved
2018-03-15 17:27hgbotResolutionopen => fixed
2018-03-15 17:27hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/72f9f1727bc1613718fd11fc714294c7df86df88 [^]
2018-03-15 17:28shuehnerReview Assigned To => alostale
2018-03-16 08:59alostaleTag Attached: Performance
2018-03-16 09:00alostaleNote Added: 0103303
2018-03-16 09:00alostaleStatusresolved => closed
2018-03-16 09:00alostaleFixed in Version => 3.0PR18Q2

Notes
(0103287)
hgbot   
2018-03-15 17:27   
Repository: erp/devel/pi
Changeset: 72f9f1727bc1613718fd11fc714294c7df86df88
Author: Stefan Hühner <stefan.huehner <at> openbravo.com>
Date: Thu Mar 15 10:41:23 2018 +0100
URL: http://code.openbravo.com/erp/devel/pi/rev/72f9f1727bc1613718fd11fc714294c7df86df88 [^]

Fixed 38137. Use-bind parameters instead of mixing data values in hql-String.

---
M src/org/openbravo/dal/security/EntityAccessChecker.java
---
(0103303)
alostale   
2018-03-16 09:00   
reviewed + tested