search

cuba-platform / cuba

CUBA Platform is a high level framework for enterprise applications development
https://www.cuba-platform.com
Apache License 2.0
1.34k stars 219 forks source link

The 'Read-only' permission does not work for TokenList in legacy screens #3280

Closed volyanskiy closed 2 years ago

volyanskiy commented 2 years ago

Code which checks this security rule - com.haulmont.cuba.gui.components.data.value.ValueBinder#bind image This check works only if valueSource instanceof EntityValueSource and in Legacy screens TokenList's valueSource = com.haulmont.cuba.gui.components.data.value.LegacyCollectionDsValueSource which is not the EntityValueSource and it can be the root cause of the issue.

TC:

  1. Create two entities with ManyToMany relation between them.
  2. Create the legacy screen with legacy datasource and TokenList linked with it.
  3. Create the Role with Read-only attribute's permission on ManyToMany attribute.

ER: TokenList should not be editable. AR: TokenList is editable.