cuba-platform/cuba

The 'Read-only' permission does not work for TokenList in legacy screens

volyanskiy opened this issue · 0 comments

volyanskiy commented
  • Platform version: 7.2.19

Code which checks this security rule - com.haulmont.cuba.gui.components.data.value.ValueBinder#bind
image
This check works only if valueSource instanceof EntityValueSource and in Legacy screens TokenList's valueSource = com.haulmont.cuba.gui.components.data.value.LegacyCollectionDsValueSource which is not the EntityValueSource and it can be the root cause of the issue.

TC:

  1. Create two entities with ManyToMany relation between them.
  2. Create the legacy screen with legacy datasource and TokenList linked with it.
  3. Create the Role with Read-only attribute's permission on ManyToMany attribute.

ER: TokenList should not be editable.
AR: TokenList is editable.