cuba-platform/cuba

DataManager doesn't check entityAttributePermissions

racoy opened this issue · 1 comments

racoy commented

Environment

  • Platform version: 7.2.17
  • Browser: Chrome
  • Database: PostgreSQL
  • Operating system: Windows

Description of the bug or enhancement

DataManager doesn't check @EntityAttributeAccess on Entity.
For example: StoreEmployeeRole can change importantField(view only in security settings)

    @Role(name = StoreEmployeeRole.NAME)
public class StoreEmployeeRole extends AnnotatedRoleDefinition {
    public final static String NAME = "StoreEmployee";

    @EntityAccess(entityClass = Store.class, operations = {EntityOp.READ, EntityOp.UPDATE})
    @Override
    public EntityPermissionsContainer entityPermissions() {
        return super.entityPermissions();
    }

    @EntityAttributeAccess(entityClass = Store.class, view = "*", modify = "notImportantField")
    @Override
    public EntityAttributePermissionsContainer entityAttributePermissions() {
        return super.entityAttributePermissions();
    }

    @ScreenAccess(screenIds = {"seccollapse_Store.browse", "seccollapse_Store.edit", "network-menu", "application-seccollapse"})
    @Override
    public ScreenPermissionsContainer screenPermissions() {
        return super.screenPermissions();
    }
}
  1. Create user with SoreEmployee role
  2. Create Store instance
  3. click on "just button" in store editor
    @Subscribe("justBtn")
    public void onJustBtnClick(Button.ClickEvent event) {
        storeDc.getItem().setImportantField((long) (Math.random()*1000));
    }
  1. click "Ok" for save entity

ER-Exception
AR-successful commit

Simple demostrate project here:
seccollapse.zip

DataManager checks entity attribute permissions only if you set cuba.entityAttributePermissionChecking to true.
See https://doc.cuba-platform.com/manual-7.2/data_access_checks.html