midsuit
/
core-jgi
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

IDEMPIERE-4213 Window Toolbar attached processes are doesn't validate role access (#265)

This commit is contained in:
Carlos Ruiz 2020-09-22 04:52:46 +02:00 committed by GitHub
parent c5079d5106
commit 1ddbe3eef5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
org.adempiere.base/src/org/compiere/model/GridField.java
View File

@ -505,6 +505,13 @@ public class GridField
return false; return false;
if (!MRole.getDefault(ctx, false).isColumnAccess(AD_Table_ID, m_vo.AD_Column_ID, false)) if (!MRole.getDefault(ctx, false).isColumnAccess(AD_Table_ID, m_vo.AD_Column_ID, false))
return false; return false;
if (getDisplayType() == DisplayType.Button && getAD_Process_ID() > 0) {
// Verify access to process for buttons
Boolean access = MRole.getDefault().getProcessAccess(getAD_Process_ID());
if (access == null || !access.booleanValue())
return false;
}
} }
} }

11
org.adempiere.base/src/org/compiere/model/MRole.java
View File

@ -39,6 +39,7 @@ import java.util.logging.Level;
import org.adempiere.exceptions.AdempiereException; import org.adempiere.exceptions.AdempiereException;
import org.compiere.util.CLogger; import org.compiere.util.CLogger;
import org.compiere.util.DB; import org.compiere.util.DB;
import org.compiere.util.DisplayType;
import org.compiere.util.Env; import org.compiere.util.Env;
import org.compiere.util.Ini; import org.compiere.util.Ini;
import org.compiere.util.KeyNamePair; import org.compiere.util.KeyNamePair;
@ -1463,7 +1464,15 @@ public final class MRole extends X_AD_Role implements ImmutablePOSupport
if (!isTableAccess(AD_Table_ID, ro)) // No Access to Table if (!isTableAccess(AD_Table_ID, ro)) // No Access to Table
return false; return false;
loadColumnAccess(false); loadColumnAccess(false);
// Verify access to process for buttons
MColumn column = MColumn.get(Env.getCtx(), AD_Column_ID);
if (column.getAD_Reference_ID() == DisplayType.Button && column.getAD_Process_ID() > 0) {
Boolean access = MRole.getDefault().getProcessAccess(column.getAD_Process_ID());
if (access == null)
return false;
}
boolean retValue = true; // assuming exclusive boolean retValue = true; // assuming exclusive
for (int i = 0; i < m_columnAccess.length; i++) for (int i = 0; i < m_columnAccess.length; i++)
{ {