0038477: SS WebPOS shows all users, more than allowed according to posterminalaccess

diff --git a/src-db/database/sourcedata/AD_REF_LIST.xml b/src-db/database/sourcedata/AD_REF_LIST.xml
--- a/src-db/database/sourcedata/AD_REF_LIST.xml
+++ b/src-db/database/sourcedata/AD_REF_LIST.xml
@@ -579,6 +579,19 @@
 <!--39E615E00A7049298B5BEE45D7C63403-->  <AD_MODULE_ID><![CDATA[FF808181326CC34901326D53DBCF0018]]></AD_MODULE_ID>
 <!--39E615E00A7049298B5BEE45D7C63403--></AD_REF_LIST>
 
+<!--3AACBA31D4034ADA983CC1D5C51985D3--><AD_REF_LIST>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <AD_REF_LIST_ID><![CDATA[3AACBA31D4034ADA983CC1D5C51985D3]]></AD_REF_LIST_ID>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <AD_CLIENT_ID><![CDATA[0]]></AD_CLIENT_ID>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <AD_ORG_ID><![CDATA[0]]></AD_ORG_ID>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <ISACTIVE><![CDATA[Y]]></ISACTIVE>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <VALUE><![CDATA[OBPOS_FILTER_USER_ONLY_BY_TERMINAL_ACCESS]]></VALUE>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <NAME><![CDATA[Filter User Images only on TerminalAccess]]></NAME>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <DESCRIPTION><![CDATA[Filter which user images to show on the basis of the existing terminal access records]]></DESCRIPTION>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <AD_REFERENCE_ID><![CDATA[A26BA480E2014707B47257024C3CBFF7]]></AD_REFERENCE_ID>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <AD_MODULE_ID><![CDATA[FF808181326CC34901326D53DBCF0018]]></AD_MODULE_ID>
+<!--3AACBA31D4034ADA983CC1D5C51985D3-->  <SEQNO><![CDATA[10]]></SEQNO>
+<!--3AACBA31D4034ADA983CC1D5C51985D3--></AD_REF_LIST>
+
 <!--3E5BC9B9EA0041FBBA3C116AD65FF480--><AD_REF_LIST>
 <!--3E5BC9B9EA0041FBBA3C116AD65FF480-->  <AD_REF_LIST_ID><![CDATA[3E5BC9B9EA0041FBBA3C116AD65FF480]]></AD_REF_LIST_ID>
 <!--3E5BC9B9EA0041FBBA3C116AD65FF480-->  <AD_CLIENT_ID><![CDATA[0]]></AD_CLIENT_ID>
diff --git a/src/org/openbravo/retail/posterminal/LoginUtilsServlet.java b/src/org/openbravo/retail/posterminal/LoginUtilsServlet.java
--- a/src/org/openbravo/retail/posterminal/LoginUtilsServlet.java
+++ b/src/org/openbravo/retail/posterminal/LoginUtilsServlet.java
@@ -122,6 +122,11 @@
           .getOrganizationStructureProvider(terminalObj.getClient().getId())
           .getNaturalTree(terminalObj.getOrganization().getId()));
 
+      String extraFilter = "";
+      if (!doFilterUserOnlyByTerminalAccessPreference()) {
+        extraFilter = "not exists(from OBPOS_TerminalAccess ta where ta.userContact = user) or ";
+      }
+
       String hqlUser = "select distinct user.name, user.username, user.id "
           + "from ADUser user, ADUserRoles userRoles, ADRole role, "
           + "ADFormAccess formAccess, OBPOS_Applications terminal "
@@ -132,7 +137,7 @@
           + "user.username is not null and "
           + "user.password is not null and "
           + "exists (from ADRoleOrganization ro where ro.role = role and ro.organization = terminal.organization) and "
-          + "(not exists(from OBPOS_TerminalAccess ta where ta.userContact = user) or exists(from OBPOS_TerminalAccess ta where ta.userContact = user and ta.pOSTerminal=terminal)) and "
+          + "(" + extraFilter + "exists(from OBPOS_TerminalAccess ta where ta.userContact = user and ta.pOSTerminal=terminal)) and "
           + "terminal.searchKey = :theTerminalSearchKey and "
           + "user.id = userRoles.userContact.id and userRoles.role.id = role.id and "
           + "userRoles.role.id = formAccess.role.id and "
@@ -198,6 +203,21 @@
     return result;
   }
 
+  public static boolean doFilterUserOnlyByTerminalAccessPreference() {
+    try {
+      OBContext.setAdminMode(false);
+      final String value = Preferences.getPreferenceValue(
+          "OBPOS_FILTER_USER_ONLY_BY_TERMINAL_ACCESS", true, OBContext.getOBContext()
+              .getCurrentClient(), OBContext.getOBContext().getCurrentOrganization(), OBContext
+              .getOBContext().getUser(), OBContext.getOBContext().getRole(), null);
+      return "Y".equals(value);
+    } catch (Exception e) {
+      return false;
+    } finally {
+      OBContext.restorePreviousMode();
+    }
+  }
+
   @Override
   protected JSONObject getPrerrenderData(HttpServletRequest request) throws JSONException {
 

diff --git a/src-db/database/sourcedata/AD_PREFERENCE.xml b/src-db/database/sourcedata/AD_PREFERENCE.xml
new file mode 100644
--- /dev/null
+++ b/src-db/database/sourcedata/AD_PREFERENCE.xml
@@ -0,0 +1,14 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<data>
+<!--B7729A9345CB4824BB481EF645368737--><AD_PREFERENCE>
+<!--B7729A9345CB4824BB481EF645368737-->  <AD_PREFERENCE_ID><![CDATA[B7729A9345CB4824BB481EF645368737]]></AD_PREFERENCE_ID>
+<!--B7729A9345CB4824BB481EF645368737-->  <AD_CLIENT_ID><![CDATA[0]]></AD_CLIENT_ID>
+<!--B7729A9345CB4824BB481EF645368737-->  <AD_ORG_ID><![CDATA[0]]></AD_ORG_ID>
+<!--B7729A9345CB4824BB481EF645368737-->  <ISACTIVE><![CDATA[Y]]></ISACTIVE>
+<!--B7729A9345CB4824BB481EF645368737-->  <VALUE><![CDATA[Y]]></VALUE>
+<!--B7729A9345CB4824BB481EF645368737-->  <PROPERTY><![CDATA[OBPOS_FILTER_USER_ONLY_BY_TERMINAL_ACCESS]]></PROPERTY>
+<!--B7729A9345CB4824BB481EF645368737-->  <ISPROPERTYLIST><![CDATA[Y]]></ISPROPERTYLIST>
+<!--B7729A9345CB4824BB481EF645368737-->  <AD_MODULE_ID><![CDATA[16134DEBE87D4D138BE37FFDB750E609]]></AD_MODULE_ID>
+<!--B7729A9345CB4824BB481EF645368737--></AD_PREFERENCE>
+
+</data>