Project:
| View Issue Details[ Jump to Notes ] | [ Issue History ] [ Print ] | |||||||
| ID | ||||||||
| 0038137 | ||||||||
| Type | Category | Severity | Reproducibility | Date Submitted | Last Update | |||
| defect | [Openbravo ERP] A. Platform | minor | have not tried | 2018-03-14 13:13 | 2018-03-16 09:00 | |||
| Reporter | shuehner | View Status | public | |||||
| Assigned To | shuehner | |||||||
| Priority | normal | Resolution | fixed | Fixed in Version | 3.0PR18Q2 | |||
| Status | closed | Fix in branch | Fixed in SCM revision | 72f9f1727bc1 | ||||
| Projection | none | ETA | none | Target Version | ||||
| OS | Any | Database | Any | Java version | ||||
| OS Version | Database version | Ant version | ||||||
| Product Version | SCM revision | |||||||
| Review Assigned To | alostale | |||||||
| Web browser | ||||||||
| Modules | Core | |||||||
| Regression level | ||||||||
| Regression date | ||||||||
| Regression introduced in release | ||||||||
| Regression introduced by commit | ||||||||
| Triggers an Emergency Pack | No | |||||||
| Summary | 0038137: EntityAccessChecker.initialize is not using bind-variables | |||||||
| Description | This code is not using bind-variables: final String tafQryStr = "select ta from " + TableAccess.class.getName() + " ta where role.id='" + getRoleId() + "'"; @SuppressWarnings("unchecked") final List<TableAccess> tas = SessionHandler.getInstance().createQuery(tafQryStr).list(); // and take into account explicit process access final String processAccessQryStr = "select p.obuiappProcess.id from " + ProcessAccess.class.getName() + " p where p.role.id='" + getRoleId() + "'"; | |||||||
| Steps To Reproduce | - | |||||||
| Tags | Performance | |||||||
| Attached Files | ||||||||
 Relationships [ Relation Graph ]
[ Dependency Graph ]
|
||||||||
|
||||||||
 Relationships |
|
Notes |
|
|
(0103287) hgbot (developer) 2018-03-15 17:27 |
Repository: erp/devel/pi Changeset: 72f9f1727bc1613718fd11fc714294c7df86df88 Author: Stefan Hühner <stefan.huehner <at> openbravo.com> Date: Thu Mar 15 10:41:23 2018 +0100 URL: http://code.openbravo.com/erp/devel/pi/rev/72f9f1727bc1613718fd11fc714294c7df86df88 [^] Fixed 38137. Use-bind parameters instead of mixing data values in hql-String. --- M src/org/openbravo/dal/security/EntityAccessChecker.java --- |
|
(0103303) alostale (manager) 2018-03-16 09:00 |
reviewed + tested |
|
Notes |
|
Issue History |
|||
| Date Modified | Username | Field | Change |
| 2018-03-14 13:13 | shuehner | New Issue | |
| 2018-03-14 13:13 | shuehner | Assigned To | => platform |
| 2018-03-14 13:13 | shuehner | Modules | => Core |
| 2018-03-14 13:13 | shuehner | Triggers an Emergency Pack | => No |
| 2018-03-14 13:13 | shuehner | Relationship added | blocks 0038136 |
| 2018-03-14 16:46 | shuehner | Assigned To | platform => shuehner |
| 2018-03-14 17:27 | shuehner | Description Updated | View Revisions |
| 2018-03-15 17:27 | hgbot | Checkin | |
| 2018-03-15 17:27 | hgbot | Note Added: 0103287 | |
| 2018-03-15 17:27 | hgbot | Status | new => resolved |
| 2018-03-15 17:27 | hgbot | Resolution | open => fixed |
| 2018-03-15 17:27 | hgbot | Fixed in SCM revision | => http://code.openbravo.com/erp/devel/pi/rev/72f9f1727bc1613718fd11fc714294c7df86df88 [^] |
| 2018-03-15 17:28 | shuehner | Review Assigned To | => alostale |
| 2018-03-16 08:59 | alostale | Tag Attached: Performance | |
| 2018-03-16 09:00 | alostale | Note Added: 0103303 | |
| 2018-03-16 09:00 | alostale | Status | resolved => closed |
| 2018-03-16 09:00 | alostale | Fixed in Version | => 3.0PR18Q2 |
|
Issue History |
| Copyright © 2000 - 2009 MantisBT Group |
 |