From 817cd5fd65e7503b253c910f64098afadcd2aee7 Mon Sep 17 00:00:00 2001
From: Carlos Ruiz <carg67@gmail.com>
Date: Thu, 28 Nov 2019 13:36:17 +0100
Subject: [PATCH] IDEMPIERE-3218 Cross-tenant error when importing web service
 security records / fix problem when importing attachments because of
 Record_ID column

---
 .../src/org/compiere/model/MColumn.java       | 10 ++++--
 .../src/org/adempiere/pipo2/PoFiller.java     | 35 +++++++++++++------
 2 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/org.adempiere.base/src/org/compiere/model/MColumn.java b/org.adempiere.base/src/org/compiere/model/MColumn.java
index c190e52b5c..a8997afa2b 100644
--- a/org.adempiere.base/src/org/compiere/model/MColumn.java
+++ b/org.adempiere.base/src/org/compiere/model/MColumn.java
@@ -796,7 +796,7 @@ public class MColumn extends X_AD_Column
 		int refid = getAD_Reference_ID();
 		if (DisplayType.TableDir == refid || (DisplayType.Search == refid && getAD_Reference_Value_ID() == 0)) {
 			foreignTable = getColumnName().substring(0, getColumnName().length()-3);
-		} else 	if (DisplayType.Table == refid || DisplayType.Search == refid) {
+		} else if (DisplayType.Table == refid || DisplayType.Search == refid) {
 			MReference ref = MReference.get(getCtx(), getAD_Reference_Value_ID());
 			if (MReference.VALIDATIONTYPE_TableValidation.equals(ref.getValidationType())) {
 				int cnt = DB.getSQLValueEx(get_TrxName(), "SELECT COUNT(*) FROM AD_Ref_Table WHERE AD_Reference_ID=?", getAD_Reference_Value_ID());
@@ -806,7 +806,13 @@ public class MColumn extends X_AD_Column
 						foreignTable = rt.getAD_Table().getTableName();
 				}
 			}
-		} else 	if (DisplayType.List == refid || DisplayType.Payment == refid) {
+		} else if (DisplayType.Button == refid) {
+			// C_BPartner.AD_OrgBP_ID and C_Project.C_ProjectType_ID are defined as buttons
+			if ("AD_OrgBP_ID".equalsIgnoreCase(getColumnName()))
+				foreignTable = "AD_Org";
+			else if ("C_ProjectType_ID".equalsIgnoreCase(getColumnName()))
+				foreignTable = "C_ProjectType";
+		} else if (DisplayType.List == refid || DisplayType.Payment == refid) {
 			foreignTable = "AD_Ref_List";
 		} else if (DisplayType.Location == refid) {
 			foreignTable = "C_Location";
diff --git a/org.adempiere.pipo/src/org/adempiere/pipo2/PoFiller.java b/org.adempiere.pipo/src/org/adempiere/pipo2/PoFiller.java
index d769d34aec..db248bc2f0 100644
--- a/org.adempiere.pipo/src/org/adempiere/pipo2/PoFiller.java
+++ b/org.adempiere.pipo/src/org/adempiere/pipo2/PoFiller.java
@@ -183,17 +183,32 @@ public class PoFiller{
 			}
 			if (po.get_ColumnIndex(columnName) >= 0) {
 				MColumn col = MColumn.get(ctx.ctx, po.get_TableName(), columnName);
+				MTable foreignTable = null;
 				String refTableName = col.getReferenceTableName();
-				if (id > 0) {
-					MTable foreignTable = MTable.get(Env.getCtx(), refTableName);
-					PO subPo = foreignTable.getPO(id, po.get_TrxName());
-					if (subPo.getAD_Client_ID() != Env.getAD_Client_ID(ctx.ctx)) {
-						String accessLevel = foreignTable.getAccessLevel();
-						if ((MTable.ACCESSLEVEL_All.equals(accessLevel)
-								|| MTable.ACCESSLEVEL_SystemOnly.equals(accessLevel)
-								|| MTable.ACCESSLEVEL_SystemPlusClient.equals(accessLevel)) && 
-								subPo.getAD_Client_ID() != 0)
-							return -1;
+				if (refTableName != null) {
+					foreignTable = MTable.get(Env.getCtx(), refTableName);
+				} else {
+					if ("Record_ID".equalsIgnoreCase(columnName)) {
+						// special case - get the foreign table using column AD_Table_ID
+						int idxTableID = po.get_ColumnIndex("AD_Table_ID");
+						if (idxTableID >= 0) {
+							int tableID = po.get_ValueAsInt(idxTableID);
+							foreignTable = MTable.get(Env.getCtx(), tableID);
+							refTableName = foreignTable.getTableName();
+						}
+					}
+				}
+				if (id > 0 && refTableName != null) {
+					if (foreignTable != null) {
+						PO subPo = foreignTable.getPO(id, po.get_TrxName());
+						if (subPo != null && subPo.getAD_Client_ID() != Env.getAD_Client_ID(ctx.ctx)) {
+							String accessLevel = foreignTable.getAccessLevel();
+							if ((MTable.ACCESSLEVEL_All.equals(accessLevel)
+									|| MTable.ACCESSLEVEL_SystemOnly.equals(accessLevel)
+									|| MTable.ACCESSLEVEL_SystemPlusClient.equals(accessLevel)) && 
+									subPo.getAD_Client_ID() != 0)
+								return -1;
+						}
 					}
 
 					if (po.get_ValueAsInt(columnName) != id) {