Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Duplicate
    • Affects Version/s: None
    • Fix Version/s: 17.12.01
    • Component/s: ALL COMPONENTS
    • Labels:
      None

      Description

      As per discussion on dev mailing list (http://markmail.org/message/avn27zxog3giapvb):
      We use <if-has-permission element for checking the specified permission of logged in party.
      There are two supported attributes as well in which permission is mandatory and action is optional.
      If action is not passed then it looks for specific permission.

      For Example:
      <if-has-permission permission="LABEL_MANAGER_VIEW"/>
      It should be like <if-has-permission permission="LABEL_MANAGER" action="_VIEW"/>
      Now if someone has LABEL_MANAGER_ADMIN permission, then that user won't be granted permission. It should check for _ADMIN permission as well.

      This is properly handled when you pass action attribute, it checks for specific permission passed and _ADMIN permission as well.

      Proposed solution:

      We must use permission and action attributes at every such code occurrences to avoid this situation.

        Attachments

        1. OFBIZ-9740_plugin.patch
          24 kB
          Suraj Khurana
        2. OFBIZ-9740.patch
          26 kB
          Suraj Khurana

          Activity

            People

            • Assignee:
              deepak.dixit Deepak Dixit
              Reporter:
              suraj.khurana Suraj Khurana
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: