Anonymous | Login
Project:
RSS
  
News | My View | View Issues | Roadmap | Summary

View Issue Details[ Jump to Notes ] [ Issue History ] [ Print ]
ID
0007311
TypeCategorySeverityReproducibilityDate SubmittedLast Update
feature request[Openbravo ERP] 03. Procurement managementminoralways2009-02-02 12:282009-02-05 06:26
ReporterjoanView Statuspublic 
Assigned Topjuvara 
PrioritynormalResolutionno change requiredFixed in Version
StatusclosedFix in branchFixed in SCM revision
ProjectionnoneETAnoneTarget Version
OSLinux 64 bitDatabasePostgreSQLJava version1.5.0_14-b03
OS VersionDebian EtchDatabase version8.3Ant version1.6.5
Product Version2.40SCM revision 
Review Assigned To
Web browser
ModulesCore
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary

0007311: M_requisition Window doesn't follow security model

DescriptionIn the Requisition window, only the user that inserted the requisition can see his own requisition (defined by ad_user_id in m_requisition table) and not the same role users. I know this is a where clause in the header window and you can change it by your own. But I think the default behavoir of this window should be that all the users of the same role can see the requisitions made by this role. In this way you keep the Openbravo security model that claims to be by role, and not by user.

It is something quite confusing to the new users dont to see the documents made by the same role and just the documents created by you.
Steps To ReproduceLogin with user U1 With role R1
Create a requisition with user U1
Change to user U2 with role R1
Try to see the requisition made by U1, I think it should be displayed (not filtered)

TagsNo tags attached.
Attached Files

- Relationships [ Relation Graph ] [ Dependency Graph ]
related to feature request 0004716 closedpjuvara Requisition and Manage Requisitions form are almost identical 
related to feature request 0007374 acknowledgediciordia Secure records so that only user who created them can view them 

-  Notes
(0013161)
pjuvara (reporter)
2009-02-05 06:26

 Joan,

this is the intended behavior. Please let me explain.

The business flow that we intend to support is one where employees can request products and services to be purchased by the enterprise on their behalf. These could be, for instance, raw materials that the VP of manufacturing needs to produce, products purchased for resale, but also expense items such as office supply or services such as legal services, consulting services, etc.

One of the requirements to support this flow is that only the employee that requested the product or service and the purchasing agent that will process it are able to view the requisition.

For instance, if I request to purchase a new set of business cards, only myself and the person who is responsible to find the most appropriate printing company and order the card need to know about it.

For this reason, we have introduced two windows who look similar but have different behavior.
- Requisitions: where employee create requisitions; to handle the above requirement, only the user who created the record is able to see it
- Manage Requisitions: where purchasing agents can see and process all the requisitions that have been created according to the normal organization based security.

Please notice that, while in an unconfigured system this might look a bit confusing because both windows sit side by side, in a properly configured system these two windows would not belong to the same role. You should configure the system with at least two roles:
- Employee: having access to Requistions
- Purchasing agent: having access to Manage Requisition

Please feel free to reopen this feature request if you disagree with this explanation.

Paolo

- Issue History
Date Modified Username Field Change
2009-02-02 12:28 joan New Issue
2009-02-02 12:28 joan Assigned To => rafaroda
2009-02-02 12:28 joan sf_bug_id 0 => 2556621
2009-02-03 16:31 rafaroda Assigned To rafaroda => pjuvara
2009-02-05 06:26 pjuvara Regression testing => No
2009-02-05 06:26 pjuvara Status new => closed
2009-02-05 06:26 pjuvara Note Added: 0013161
2009-02-05 06:26 pjuvara Resolution open => no change required
2009-02-05 06:32 pjuvara Relationship added related to 0004716
2009-02-05 06:43 pjuvara Relationship added related to 0007374

Copyright © 2000 - 2009 MantisBT Group
Powered by Mantis Bugtracker