Project:
| View Issue Details[ Jump to Notes ] | [ Issue History ] [ Print ] | |||||||
| ID | ||||||||
| 0009979 | ||||||||
| Type | Category | Severity | Reproducibility | Date Submitted | Last Update | |||
| defect | [Openbravo ERP] C. Security | major | always | 2009-07-21 12:09 | 2009-08-18 00:00 | |||
| Reporter | networkb | View Status | public | |||||
| Assigned To | alostale | |||||||
| Priority | immediate | Resolution | fixed | Fixed in Version | pi | |||
| Status | closed | Fix in branch | pi | Fixed in SCM revision | 53febb6b06a5 | |||
| Projection | none | ETA | none | Target Version | ||||
| OS | Any | Database | Any | Java version | ||||
| OS Version | Database version | Ant version | ||||||
| Product Version | 2.40MP7 | SCM revision | ||||||
| Review Assigned To | ||||||||
| Web browser | ||||||||
| Modules | Core | |||||||
| Regression level | ||||||||
| Regression date | ||||||||
| Regression introduced in release | ||||||||
| Regression introduced by commit | ||||||||
| Triggers an Emergency Pack | No | |||||||
| Summary | 0009979: Linked items show elements in windows where the role has no permission | |||||||
| Description | For example, a role is created only to access to Business Partner window. A user access the application with this role. Go to Business Partner, and select an existing one. Press Linked items, and shows information, for example, about Manual settlement. This is not correct. It must only show information about those elements that role can navigate. | |||||||
| Steps To Reproduce | 1)Create a Business partner. Select as Employee. Go to Manual Settlement. Create a new one. In Create payment tab, select the partner in 1). As amount, 1000. Go to Balance payment, select one GL/Item, and enter 1000 as debit amount. Process it. Back to Business partner window. Press linked items. The manual settlement is shown (it is supposed that role can access to Manual Settlement) ------------------- Create a new role, just to access Business partner window. Create a new user for this role. Enter as this user. Go to Business Partner window. Find the partner created in 1) Press Linked items. Pop-up shows a link to Manual Settlement, including its amount. This must not happen | |||||||
| Tags | No tags attached. | |||||||
| Attached Files | ||||||||
 Relationships [ Relation Graph ]
[ Dependency Graph ]
|
|||||||||||||||
|
|||||||||||||||
 Relationships |
|
Notes |
|
|
(0018479) rafaroda (developer) 2009-07-21 12:31 |
Asier, can you please take action on this issue? Thanks. |
|
(0018499) hgbot (developer) 2009-07-21 17:31 |
Repository: erp/devel/pi Changeset: 53febb6b06a577ec5ea8ff539e27f1edab94a0b9 Author: Asier Lostalé <asier.lostale <at> openbravo.com> Date: Tue Jul 21 17:15:25 2009 +0200 URL: http://code.openbravo.com/erp/devel/pi/rev/53febb6b06a577ec5ea8ff539e27f1edab94a0b9 [^] fixed bug 0009979: Linked items show elements in windows where the role has no permission --- M src/org/openbravo/erpCommon/utility/UsedByLink.java M src/org/openbravo/erpCommon/utility/UsedByLink_data.xsql --- |
|
(0018976) sureshbabu (reporter) 2009-08-17 14:08 |
system throws warning message as Warning: There are non accessible records |
|
Notes |
|
Issue History |
|||
| Date Modified | Username | Field | Change |
| 2009-07-21 12:09 | networkb | New Issue | |
| 2009-07-21 12:09 | networkb | Assigned To | => rafaroda |
| 2009-07-21 12:31 | rafaroda | Note Added: 0018479 | |
| 2009-07-21 12:31 | rafaroda | Assigned To | rafaroda => alostale |
| 2009-07-21 12:41 | rafaroda | Status | new => scheduled |
| 2009-07-21 12:41 | rafaroda | fix_in_branch | => pi |
| 2009-07-21 13:41 | rafaroda | Relationship added | related to 0009705 |
| 2009-07-21 17:31 | hgbot | Checkin | |
| 2009-07-21 17:31 | hgbot | Note Added: 0018499 | |
| 2009-07-21 17:31 | hgbot | Status | scheduled => resolved |
| 2009-07-21 17:31 | hgbot | Resolution | open => fixed |
| 2009-07-21 17:31 | hgbot | Fixed in SCM revision | => http://code.openbravo.com/erp/devel/pi/rev/53febb6b06a577ec5ea8ff539e27f1edab94a0b9 [^] |
| 2009-08-17 14:08 | sureshbabu | Status | resolved => closed |
| 2009-08-17 14:08 | sureshbabu | Note Added: 0018976 | |
| 2009-08-17 14:08 | sureshbabu | Fixed in Version | => pi |
| 2009-08-18 00:00 | anonymous | sf_bug_id | 0 => 2839265 |
|
Issue History |
| Copyright © 2000 - 2009 MantisBT Group |
 |