midsuit
/
core-jgi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

IDEMPIERE-4268 Web Services : Read miss cross-tenant check (#436) 

Two more points found about cross tenant readin in MClient and MUser
This commit is contained in:
Carlos Ruiz 2020-12-05 05:42:43 +01:00 committed by GitHub
parent 894ceb8c4f
commit 02ce1f3c1f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 28 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
org.adempiere.base/src/org/compiere/model/MClient.java
View File

@ -104,9 +104,21 @@ public class MClient extends X_AD_Client implements ImmutablePOSupport
*/ */
public static MClient[] getAll (Properties ctx, String orderBy) public static MClient[] getAll (Properties ctx, String orderBy)
{ {
List<MClient> list = new Query(ctx,I_AD_Client.Table_Name,(String)null,(String)null) List<MClient> list = null;
int cid = Env.getAD_Client_ID(Env.getCtx());
try {
if (cid > 0) {
// forced potential cross tenant read - requires System client in context
Env.setContext(Env.getCtx(), Env.AD_CLIENT_ID, 0);
}
list = new Query(ctx,I_AD_Client.Table_Name,(String)null,(String)null)
.setOrderBy(orderBy) .setOrderBy(orderBy)
.list(); .list();
} finally {
if (cid > 0) {
Env.setContext(Env.getCtx(), Env.AD_CLIENT_ID, cid);
}
}
for(MClient client:list ){ for(MClient client:list ){
s_cache.put (Integer.valueOf(client.getAD_Client_ID()), client, e -> new MClient(Env.getCtx(), e)); s_cache.put (Integer.valueOf(client.getAD_Client_ID()), client, e -> new MClient(Env.getCtx(), e));
} }

11
org.adempiere.base/src/org/compiere/model/MUser.java
View File

@ -822,8 +822,19 @@ public class MUser extends X_AD_User implements ImmutablePOSupport
pstmt.setInt (3, getAD_User_ID()); pstmt.setInt (3, getAD_User_ID());
pstmt.setInt (4, AD_Org_ID); pstmt.setInt (4, AD_Org_ID);
rs = pstmt.executeQuery (); rs = pstmt.executeQuery ();
int cid = Env.getAD_Client_ID(Env.getCtx());
try {
if (cid > 0) {
// forced potential cross tenant read - requires System client in context
Env.setContext(Env.getCtx(), Env.AD_CLIENT_ID, 0);
}
while (rs.next ()) while (rs.next ())
list.add (new MRole(Env.getCtx(), rs, get_TrxName())); list.add (new MRole(Env.getCtx(), rs, get_TrxName()));
} finally {
if (cid > 0) {
Env.setContext(Env.getCtx(), Env.AD_CLIENT_ID, cid);
}
}
} }
catch (Exception e) catch (Exception e)
{ {