Openbravo Issue Tracking System - Openbravo ERP | |||||||||||||||||||
View Issue Details | |||||||||||||||||||
ID | Project | Category | View Status | Date Submitted | Last Update | ||||||||||||||
0005542 | Openbravo ERP | C. Security | public | 2008-10-15 18:52 | 2008-12-31 12:13 | ||||||||||||||
Reporter | nataliaperu | ||||||||||||||||||
Assigned To | iciordia | ||||||||||||||||||
Priority | high | Severity | major | Reproducibility | always | ||||||||||||||
Status | closed | Resolution | no change required | ||||||||||||||||
Platform | OS | 5 | OS Version | ||||||||||||||||
Product Version | |||||||||||||||||||
Target Version | Fixed in Version | ||||||||||||||||||
Merge Request Status | |||||||||||||||||||
Review Assigned To | |||||||||||||||||||
OBNetwork customer | |||||||||||||||||||
Web browser | |||||||||||||||||||
Modules | Core | ||||||||||||||||||
Support ticket | |||||||||||||||||||
Regression level | |||||||||||||||||||
Regression date | |||||||||||||||||||
Regression introduced in release | |||||||||||||||||||
Regression introduced by commit | |||||||||||||||||||
Triggers an Emergency Pack | No | ||||||||||||||||||
Summary | 0005542: Foreign keys must be included in CREATEDBY and UPDATEDBY fields | ||||||||||||||||||
Description | CREATEDBY and UPDATEDBY columns within all Openbravo ERP tables are used for auditing purposes. These columns are filled with the ID of the logged user that creates or updates the record. This user has to be recorded in AD_USER table. The problem is that in many (IF NOT ALL) tables do not have as foreign key the AD_USER_ID column of the AD_USER table for CREATEDBY and UPDATEDBY columns. As a result of this, one can delete one record from AD_USER table even if this user has created or updated records. It is known that this has caused problems with the upgrader from Openbravo ERP MP4 to MP5 where some users were deleted (those who had AD_CLIENT_ID = 0). Since no foreign key exists in CREATEDBY and UPDATEDBY fields, for example in C_INVOICE table, there are records in C_INVOICE table within users that do not exist in the database. | ||||||||||||||||||
Steps To Reproduce | 1) Logged as Client Admin, create a new User and assign him a Role. 2) Log out and log in with this user and create a new transaction, for instance, an invoice. 3) Log out and log in again as Client Admin and deleted the previously created User. You are able to do it since CREATEDBY and UPDATEDBY columns have not AD_USER_ID as a foreign key. | ||||||||||||||||||
Proposed Solution | The solution for this issue would be add the following lines in all the XML tables withing /src-db/database/model/tables (changing _CINVOICE by the corresponging table name): <foreign-key foreignTable="AD_USER" name="ADUSER_CBY_CINVOICE"> <reference local="CREATEDBY" foreign="AD_USER_ID"/> </foreign-key> <foreign-key foreignTable="AD_USER" name="ADUSER_UBY_CINVOICE"> <reference local="UPDATEDBY" foreign="AD_USER_ID"/> </foreign-key> Nevertheless, a decision has to be taken since this could give a lot of errors during upgrades if any current Openbravo live implementation has inserted records in any table with an user that does not exist anymore in AD_USER table. | ||||||||||||||||||
Additional Information | |||||||||||||||||||
Tags | No tags attached. | ||||||||||||||||||
Relationships |
| ||||||||||||||||||
Attached Files | |||||||||||||||||||
Issue History | |||||||||||||||||||
Date Modified | Username | Field | Change | ||||||||||||||||
2008-10-15 18:52 | nataliaperu | New Issue | |||||||||||||||||
2008-10-15 18:52 | nataliaperu | Assigned To | => cromero | ||||||||||||||||
2008-10-15 18:52 | nataliaperu | sf_bug_id | 0 => 2168926 | ||||||||||||||||
2008-10-20 11:28 | psarobe | Priority | normal => high | ||||||||||||||||
2008-10-20 11:29 | psarobe | Status | new => scheduled | ||||||||||||||||
2008-10-20 11:29 | psarobe | fix_in_branch | => trunk | ||||||||||||||||
2008-11-05 14:15 | cromero | Assigned To | cromero => rafaroda | ||||||||||||||||
2008-11-13 22:07 | rafaroda | Assigned To | rafaroda => Dowid | ||||||||||||||||
2008-11-26 16:42 | rafaroda | Assigned To | Dowid => rafaroda | ||||||||||||||||
2008-11-26 16:50 | rafaroda | Note Added: 0010721 | |||||||||||||||||
2008-11-26 16:50 | rafaroda | fix_in_branch | trunk => | ||||||||||||||||
2008-11-26 16:50 | rafaroda | Description Updated | |||||||||||||||||
2008-11-26 16:50 | rafaroda | Proposed Solution updated | |||||||||||||||||
2008-11-26 16:50 | rafaroda | Steps to Reproduce Updated | |||||||||||||||||
2008-11-26 17:07 | rafaroda | Note Edited: 0010721 | |||||||||||||||||
2008-11-26 17:07 | rafaroda | Description Updated | |||||||||||||||||
2008-12-31 12:09 | iciordia | Note Added: 0011783 | |||||||||||||||||
2008-12-31 12:12 | iciordia | Assigned To | rafaroda => iciordia | ||||||||||||||||
2008-12-31 12:13 | iciordia | Regression testing | => No | ||||||||||||||||
2008-12-31 12:13 | iciordia | Status | scheduled => closed | ||||||||||||||||
2008-12-31 12:13 | iciordia | Note Added: 0011784 | |||||||||||||||||
2008-12-31 12:13 | iciordia | Resolution | open => no change required |
Notes | |||||
|
|||||
|
|
||||
|
|||||
|
|
||||
|
|||||
|
|