Anonymous | Login

Project:

News | My View | View Issues | Roadmap | Summary

View Issue Details[ Jump to Notes ]

[ Issue History ] [ Print ]

ID

0010548

Type

Category

Severity

Reproducibility

Date Submitted

Last Update

defect

[Openbravo ERP] C. Security

major

always

2009-09-10 14:46

2009-10-08 00:00

Reporter

villind

View Status

public

Assigned To

alostale

Priority

urgent

Resolution

fixed

Fixed in Version

2.50MP7

Status

closed

Fix in branch

pi

Fixed in SCM revision

Projection

none

ETA

none

Target Version

OS

Any

Database

Any

Java version

OS Version

Database version

Ant version

Product Version

2.40MP8

SCM revision

Review Assigned To

Web browser

Modules

Core

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

No

Summary

0010548: Adding a new organization adds org access to manual roles

Description

Adding a new organization adds org access to manual roles. This poses a security risk as the access control settings are modifid automatically where they should not be modified.

Steps To Reproduce

1. Have an role with ismanula setting active.
2. Add a new organization
3. Relogin
4. See the "Org Access" tab of the manual role

Proposed Solution

See the attached patch.

Tags

No tags attached.

no-org-for-manual-role.diff [^] (551 bytes) 2009-09-10 14:46 [Show Content] [Hide Content]

Index: src-db/database/model/triggers/AD_ORG_TRG.xml
===================================================================
--- src-db/database/model/triggers/AD_ORG_TRG.xml	(revision 14800)
+++ src-db/database/model/triggers/AD_ORG_TRG.xml	(working copy)
@@ -38,7 +38,7 @@
        'Y', now(), :new.CreatedBy,
       now(), :new.CreatedBy
     FROM AD_Role
-    WHERE AD_Client_ID=:new.AD_Client_ID;
+    WHERE AD_Client_ID=:new.AD_Client_ID and ismanual<>'Y';
     --  Create TreeNode --
     --  get AD_Tree_ID + ParentID
     SELECT c.AD_Tree_Org_ID,

Relationships [ Relation Graph ] [ Dependency Graph ]

depends on	backport	0010659		closed	alostale	Adding a new organization adds org access to manual roles
related to	defect	0030057		closed	aferraz	Org Access added automatically to all roles
causes	design defect	0030253		new	Triage Platform Base	Automatic roles and initial organization setup inconsistency

Notes
(0020208) rafaroda (developer) 2009-09-18 14:08	Thank you for the patch Ville.

(0020648) hgbot (developer) 2009-10-02 08:48	Repository: erp/devel/pi Changeset: ed4e3d66e2f427041aa4cfe4501386475d50f8d4 Author: Asier Lostalé <asier.lostale <at> openbravo.com> Date: Fri Oct 02 08:47:52 2009 +0200 URL: http://code.openbravo.com/erp/devel/pi/rev/ed4e3d66e2f427041aa4cfe4501386475d50f8d4 [^] fixed bug 0010548: Adding a new organization adds org access to manual roles --- M src-db/database/model/triggers/AD_ORG_TRG.xml ---

(0020834) sureshbabu (reporter) 2009-10-07 12:48	Tested, working fine (organization access of the newly created organization not added to the manual role by default)

Issue History
Date Modified	Username	Field	Change
2009-09-10 14:46	villind	New Issue
2009-09-10 14:46	villind	Assigned To	=> rafaroda
2009-09-10 14:46	villind	File Added: no-org-for-manual-role.diff
2009-09-18 14:08	rafaroda	Note Added: 0020208
2009-09-18 14:08	rafaroda	Assigned To	rafaroda => alostale
2009-09-18 14:08	rafaroda	Priority	normal => urgent
2009-09-18 14:08	rafaroda	Status	new => scheduled
2009-09-18 14:08	rafaroda	fix_in_branch	=> pi
2009-10-02 08:48	hgbot	Checkin
2009-10-02 08:48	hgbot	Note Added: 0020648
2009-10-02 08:48	hgbot	Status	scheduled => resolved
2009-10-02 08:48	hgbot	Resolution	open => fixed
2009-10-02 08:48	hgbot	Fixed in SCM revision	=> http://code.openbravo.com/erp/devel/pi/rev/ed4e3d66e2f427041aa4cfe4501386475d50f8d4 [^]
2009-10-07 12:48	sureshbabu	Status	resolved => closed
2009-10-07 12:48	sureshbabu	Note Added: 0020834
2009-10-07 12:48	sureshbabu	Fixed in Version	=> 2.50MP7
2009-10-08 00:00	anonymous	sf_bug_id	0 => 2874364
2015-06-03 19:06	aferraz	Relationship added	related to 0030057
2015-06-26 09:17	vmromanos	Relationship added	causes 0030253

Copyright © 2000 - 2009 MantisBT Group