Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0056631Openbravo ERPC. Securitypublic2024-10-03 09:072025-03-27 15:47
Reportereduardo_Argal 
Assigned ToAugustoMauch 
PriorityimmediateSeveritymajorReproducibilityalways
StatusclosedResolutionduplicate 
PlatformOS5OS Version
Product Versionpi 
Target VersionpiFixed in Version 
Merge Request Statusapproved
Review Assigned To
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression levelProduction - Confirmed Stable
Regression date2023-10-17
Regression introduced in releasePR24Q1
Regression introduced by commit
Triggers an Emergency PackNo
Summary0056631: A user with a not Manual role can access, edit and create transactions in any organization
DescriptionA user with a not Manual role can access, edit and create transactions in any organization even if the organization access is limited to one store.
Steps To Reproduce1) Log as Orhi Store User
2) Go to Purchase Order Window
3) Create a new record
4) Mind that the organization combo displays the full list of organization when it should just display the organizations defined in the Org Access tab for his/her role
5) change the configuration for the role to Manual
6) Repeat the steps and mind that now the organizatiuon combo works properly
Proposed SolutionWorkaround: it is possible to prevent access to organizations for automatic roles by creating those roles as disable (Active = false) in the Role > Org Access tab.
Additional Information
TagsNo tags attached.
Relationships
depends on backport 0057255PR24Q4.2 new Triage Platform Base A user with a not Manual role can access, edit and create transactions in any organization 
depends on backport 0058045PR25Q1.1 scheduled Triage Platform Base A user with a not Manual role can access, edit and create transactions in any organization 
caused by defect 0053408 closed ablasco Do not persist access for automatic roles 
Not all the children of this issue are yet resolved or closed.
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2024-10-03 09:07eduardo_ArgalNew Issue
2024-10-03 09:07eduardo_ArgalAssigned To => alostale
2024-10-03 09:07eduardo_ArgalOBNetwork customer => No
2024-10-03 09:07eduardo_ArgalModules => Core
2024-10-03 09:07eduardo_ArgalRegression level => Production - Confirmed Stable
2024-10-03 09:07eduardo_ArgalTriggers an Emergency Pack => No
2024-10-15 10:34alostaleAssigned Toalostale => Triage Platform Base
2024-10-17 14:38AugustoMauchProposed Solution updated
2024-10-17 14:39AugustoMauchProposed Solution updated
2024-11-22 11:13AugustoMauchStatusnew => scheduled
2024-11-25 23:27hgbotMerge Request Status => open
2024-11-25 23:27hgbotNote Added: 0172565
2024-11-28 10:32alostaleRelationship addedcaused by 0053408
2024-11-28 10:33alostaleRegression date => 2023-10-17
2024-11-28 10:33alostaleRegression introduced in release => PR24Q1
2024-11-28 10:36alostaleProposed Solution updated
2025-02-12 11:46hgbotMerge Request Statusopen => approved
2025-02-21 08:34AugustoMauchStatusscheduled => closed
2025-02-21 08:35AugustoMauchStatusclosed => new
2025-02-21 08:35AugustoMauchStatusnew => scheduled
2025-02-21 08:37hgbotResolutionopen => fixed
2025-02-21 08:37hgbotStatusscheduled => closed
2025-02-21 08:37hgbotFixed in Version => PR25Q2
2025-02-21 08:37hgbotNote Added: 0176000
2025-02-21 08:37hgbotNote Added: 0176001
2025-02-21 09:11hgbotNote Added: 0176002
2025-02-21 09:12hgbotFixed in VersionPR25Q2 => PR24Q4.1
2025-02-21 09:12hgbotNote Added: 0176003
2025-02-21 09:12hgbotNote Added: 0176004
2025-02-21 10:20hgbotFixed in VersionPR24Q4.1 => PR25Q2
2025-02-21 10:20hgbotNote Added: 0176012
2025-02-23 23:23hgbotNote Added: 0176054
2025-02-24 00:18hgbotNote Added: 0176055
2025-02-24 08:44AugustoMauchNote Added: 0176061
2025-02-24 08:44AugustoMauchStatusclosed => new
2025-02-24 08:44AugustoMauchResolutionfixed => open
2025-02-24 08:44AugustoMauchFixed in VersionPR25Q2 =>
2025-02-24 08:44AugustoMauchStatusnew => acknowledged
2025-02-27 09:20hgbotResolutionopen => fixed
2025-02-27 09:20hgbotStatusacknowledged => closed
2025-02-27 09:20hgbotFixed in Version => PR24Q4.1
2025-02-27 09:20hgbotNote Added: 0176192
2025-03-27 15:46AugustoMauchAssigned ToTriage Platform Base =>
2025-03-27 15:46AugustoMauchFixed in VersionPR24Q4.1 =>
2025-03-27 15:47AugustoMauchAssigned To => AugustoMauch
2025-03-27 15:47hgbotNote Added: 0177657
2025-03-27 15:47hgbotResolutionfixed => duplicate

Notes
(0172565)
hgbot   
2024-11-25 23:27   
Merge Request created: https://gitlab.com/openbravo/product/openbravo/-/merge_requests/1457 [^]
(0176000)
hgbot   
2025-02-21 08:37   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo [^]
Changeset: 8e8d75cd209ccc558e477a8cf67066e216eda29f
Author: Augusto Mauch <amauch@orisha.com>
Date: 20-02-2025 22:28:33
URL: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/commit/8e8d75cd209ccc558e477a8cf67066e216eda29f [^]

Fixes ISSUE-56631: Automatic role should only get auto write access to 0

Auto roles should get automatic read access to all orgs by default, but only to
write access to 0

---
M referencedata/sampledata/F_B_International_Group/AD_ROLE_ORGACCESS.xml
M src/org/openbravo/base/secureApp/LoginUtils.java
M src/org/openbravo/dal/core/OBContext.java
---
(0176001)
hgbot   
2025-02-21 08:37   
Merge request merged: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/merge_requests/1457 [^]
(0176002)
hgbot   
2025-02-21 09:11   
Merge Request created: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/merge_requests/1549 [^]
(0176003)
hgbot   
2025-02-21 09:12   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo [^]
Changeset: e5fb01a0a2ae195cb818f478e91b40024ae03f72
Author: Augusto Mauch <amauch@orisha.com>
Date: 21-02-2025 09:11:16
URL: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/commit/e5fb01a0a2ae195cb818f478e91b40024ae03f72 [^]

Fixes ISSUE-56631: Automatic role should only get auto write access to 0

Auto roles should get automatic read access to all orgs by default, but only to
write access to 0

---
M referencedata/sampledata/F_B_International_Group/AD_ROLE_ORGACCESS.xml
M src/org/openbravo/base/secureApp/LoginUtils.java
M src/org/openbravo/dal/core/OBContext.java
---
(0176004)
hgbot   
2025-02-21 09:12   
Merge request merged: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/merge_requests/1549 [^]
(0176012)
hgbot   
2025-02-21 10:20   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo [^]
Changeset: 08a0bc887a7c3d76cb31bcef0c65641d3c772876
Author: Augusto Mauch <amauch@orisha.com>
Date: 21-02-2025 10:20:10
URL: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/commit/08a0bc887a7c3d76cb31bcef0c65641d3c772876 [^]

Revert "Fixes ISSUE-56631: Automatic role should only get auto write access to 0"

This reverts commit 8e8d75cd209ccc558e477a8cf67066e216eda29f.

---
M referencedata/sampledata/F_B_International_Group/AD_ROLE_ORGACCESS.xml
M src/org/openbravo/base/secureApp/LoginUtils.java
M src/org/openbravo/dal/core/OBContext.java
---
(0176054)
hgbot   
2025-02-23 23:23   
Merge Request created: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/merge_requests/1551 [^]
(0176055)
hgbot   
2025-02-24 00:18   
Merge Request created: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/pmods/org.openbravo.retail.sampledata/-/merge_requests/146 [^]
(0176061)
AugustoMauch   
2025-02-24 08:44   
Reopened, because fix was backed out, it broke CI
(0176192)
hgbot   
2025-02-27 09:20   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo [^]
Changeset: 882ef9c7955de44582c5fa02706b4a260ae50185
Author: Augusto Mauch <amauch@orisha.com>
Date: 27-02-2025 09:16:12
URL: https://gitlab.com/orisha-group/bu-commerce/openbravo/product/openbravo/-/commit/882ef9c7955de44582c5fa02706b4a260ae50185 [^]

Related to ISSUE-56631: Revert "Fixes ISSUE-56631: Automatic role should only get auto write access to 0"

This reverts commit e5fb01a0a2ae195cb818f478e91b40024ae03f72.

---
M referencedata/sampledata/F_B_International_Group/AD_ROLE_ORGACCESS.xml
M src/org/openbravo/base/secureApp/LoginUtils.java
M src/org/openbravo/dal/core/OBContext.java
---
(0177657)
hgbot   
2025-03-27 15:47   
Issue exported to Jira: https://openbravo.atlassian.net/browse/RM-24385 [^]