0058045: A user with a not Manual role can access, edit and create transactions in any organization

Openbravo Issue Tracking System - Openbravo ERP

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0058045

Openbravo ERP

C. Security

public

2024-10-03 09:07

2025-03-03 13:59

Reporter

eduardo_Argal

Assigned To

Triage Platform Base

Priority

immediate

Severity

major

Reproducibility

always

Status

scheduled

Resolution

open

Platform

OS Version

Product Version

Target Version

PR25Q1.1

Fixed in Version

Merge Request Status

approved

Review Assigned To

OBNetwork customer

Web browser

Modules

Core

Support ticket

Regression level

Production - Confirmed Stable

Regression date

2023-10-17

Regression introduced in release

PR24Q1

Regression introduced by commit

Triggers an Emergency Pack

Summary

0058045: A user with a not Manual role can access, edit and create transactions in any organization

Description

A user with a not Manual role can access, edit and create transactions in any organization even if the organization access is limited to one store.

Steps To Reproduce

1) Log as Orhi Store User
2) Go to Purchase Order Window
3) Create a new record
4) Mind that the organization combo displays the full list of organization when it should just display the organizations defined in the Org Access tab for his/her role
5) change the configuration for the role to Manual
6) Repeat the steps and mind that now the organizatiuon combo works properly

Proposed Solution

Workaround: it is possible to prevent access to organizations for automatic roles by creating those roles as disable (Active = false) in the Role > Org Access tab.

Additional Information