0054207: Cannot execute JSON WS request with roles without access to the GCSystem entity

Openbravo Issue Tracking System - Openbravo ERP

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0054207

Openbravo ERP

A. Platform

public

2023-12-22 16:17

2023-12-27 14:49

Reporter

caristu

Assigned To

Triage Platform Base

Priority

high

Severity

major

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

Fixed in Version

PR24Q1

Merge Request Status

approved

Review Assigned To

OBNetwork customer

Web browser

Modules

Core

Support ticket

Regression level

Regression date

2023-10-04

Regression introduced in release

Regression introduced by commit

https://gitlab.com/openbravo/product/openbravo/-/commit/c4e47a6e93227939e01245ebfc44072f61c86c3c [^]

Triggers an Emergency Pack

Summary

0054207: Cannot execute JSON WS request with roles without access to the GCSystem entity

Description

There is an special case where executing WS requests to the standard JSON web services fail if the execution is done by a user whose default role has not read access to the GCSystem entity

Steps To Reproduce

1- Login in Openbravo
2- Switch to use the role "Group - Admin" of The White Valley Group and set it as default role for this user. Note that this user does not have read access to the GCSystem entity
3- Restart Tomcat. This important as this way in the next step we ensure that the first request is done with a role that cannot access to the GCSystem entity
4- Make a GET request to any of the standard WS requests for example: http://localhost:8080/openbravo/org.openbravo.service.json.jsonrest/Country [^]
5- The request fails and the response shows the following error:

{"response":{"data":[{"response":{"status":-1,"error":{"message":"OBUIAPP_ActionNotAllowed","type":"user"},"totalRows":0}}

The following stack trace is shown in the log:

org.openbravo.base.exception.OBSecurityException: Entity OBUIAPP_GC_System is not readable by the user 100
    at org.openbravo.dal.security.EntityAccessChecker.checkReadable(EntityAccessChecker.java:639) ~[classes/:?]
    at org.openbravo.dal.service.OBDal.checkReadAccess(OBDal.java:749) ~[classes/:?]
    at org.openbravo.dal.service.OBDal.checkReadAccess(OBDal.java:736) ~[classes/:?]
    at org.openbravo.dal.service.OBDal.createCriteria(OBDal.java:572) ~[classes/:?]
    at org.openbravo.client.application.window.StandardWindowComponent.getSystemGridConfig(StandardWindowComponent.java:195) ~[classes/:?]
    at org.openbravo.base.GridConfigurationCache.initializeSystemConfig(GridConfigurationCache.java:74) ~[classes/:?]

Proposed Solution

Additional Information