Security subnet firewall topology for ofbiz ecommerce?

[wikitec]

Hi Guys
I am trying to get my head around a best practice for security for ofbiz
backoffice and security for ecommerce.  At this point in time I would like
to set ofbiz up so that public access cannot access backoffice database
information or only though pinholes or port forward (with different subnets)

Has anyone gone through the logistics of setting up 2 x network interface
cards (nics) on a linux box with iptables so that the backoffice if isolated
from the front ecommerce web site?  Or better still, have an answer for my
question?

I have been scrolling through posts I noticed skip wrote RE: POS Security -
web user interface? (New) By: Skip (skipdever) - 2007-10-12 08:33 something
that caught my interest, but other than that I could not find much more the
subject.

I have setup IPCop however it looks as though this will isolate my internal
network from ofbiz and will allow me to gain access through internet or KVM

I would be very interested to hear your thoughts on this matter

Thanks

phil

[BJ Freeman]

you can setup port access only.
you can use port 80 for ofbiz.
if you don't open Port 8443 on the router(firewall) then it can not be
access via the internet. you can do this buy building the IP that can
access port 8443.

you can also setup the IP addresses in your router so only local IP's
(192.168.*.* or 10.*.*.*) can access port 8443.
I always recommend you have a router/firewall box that is seperate from
your linux box.

then do the same on your linux box.


Philip Laing sent the following on 10/19/2007 6:17 AM:

> Hi Guys
> I am trying to get my head around a best practice for security for ofbiz
> backoffice and security for ecommerce.  At this point in time I would like
> to set ofbiz up so that public access cannot access backoffice database
> information or only though pinholes or port forward (with different subnets)
>
> Has anyone gone through the logistics of setting up 2 x network interface
> cards (nics) on a linux box with iptables so that the backoffice if isolated
> from the front ecommerce web site?  Or better still, have an answer for my
> question?
>
> I have been scrolling through posts I noticed skip wrote RE: POS Security -
> web user interface? (New) By: Skip (skipdever) - 2007-10-12 08:33 something
> that caught my interest, but other than that I could not find much more the
> subject.
>
> I have setup IPCop however it looks as though this will isolate my internal
> network from ofbiz and will allow me to gain access through internet or KVM
>
> I would be very interested to hear your thoughts on this matter
>
> Thanks
>
> phil
>
>
>
>
>

[SkipDever]

Log into webtools.  Click on Party tab.  Click on "Find..." at the bottom
with all the fields blank.  Select "DemoCustCompany" [Details]

At the very bottom of the page, click "Create New" in the notes area.

In the next screen, enter a noteId and note and click save at the bottom.
You get this error:

...
[noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).

....

org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)


If you look at the code referenced, you will note that if the "Note Id"
field is left blank, the NoteData entry is created and everything works
fine.


It is my view that createPartyNote() should be modified to check to see if
the NoteData exists if a noteId is passed and if not, one should be created
or else the Note id field should be removed from (or passed as hidden) the
note creation screen.

I don't actually understand why the user would be asked to enter a noteId
anyway.

I can fix this and submit a patch, but I wanted to be sure I wasn't missing
something.

Skip

[SkipDever]

There is a createPostalAddress in ContactMechServices.java

There is also a simple one ContactMechServices.xml.

In party services:

    <service name="createPostalAddress" engine="simple"
            location="org/ofbiz/party/contact/ContactMechServices.xml"
invoke="createPostalAddress" auth="true">

My question is why is there two and is there a way (beyond modifying the
servicedef) to call the java guy?

I like the java guy because it does a security check for _PCM_CREATE.

Skip

[Adrian Crum]

Skip,

It would be best to use the existing service. I am in the process of moving the embedded permission
checks to the permission services - which should correct the difference, PLUS it will enable custom
apps to piggyback custom permissions to the service.

-Adrian

skip@theDevers wrote:

> There is a createPostalAddress in ContactMechServices.java
>
> There is also a simple one ContactMechServices.xml.
>
> In party services:
>
>     <service name="createPostalAddress" engine="simple"
>             location="org/ofbiz/party/contact/ContactMechServices.xml"
> invoke="createPostalAddress" auth="true">
>
> My question is why is there two and is there a way (beyond modifying the
> servicedef) to call the java guy?
>
> I like the java guy because it does a security check for _PCM_CREATE.
>
> Skip
>
>

[Jacques Le Roux]

De : "Adrian Crum" <[hidden email]>
> Skip,
>
> It would be best to use the existing service. I am in the process of moving the embedded permission
> checks to the permission services - which should correct the difference, PLUS it will enable custom
> apps to piggyback custom permissions to the service.
>
> -Adrian

In the meantime it's easy to add a permission in  ContactMechServices.xml

Jacques

> skip@theDevers wrote:
>
> > There is a createPostalAddress in ContactMechServices.java
> >
> > There is also a simple one ContactMechServices.xml.
> >
> > In party services:
> >
> >     <service name="createPostalAddress" engine="simple"
> >             location="org/ofbiz/party/contact/ContactMechServices.xml"
> > invoke="createPostalAddress" auth="true">
> >
> > My question is why is there two and is there a way (beyond modifying the
> > servicedef) to call the java guy?
> >
> > I like the java guy because it does a security check for _PCM_CREATE.
> >
> > Skip
> >
> >
>

[Adrian Crum]

I hope to have most of the party manager changes committed by the end of the weekend.

Jacques Le Roux wrote:

> De : "Adrian Crum" <[hidden email]>
>
>>Skip,
>>
>>It would be best to use the existing service. I am in the process of moving the embedded permission
>>checks to the permission services - which should correct the difference, PLUS it will enable custom
>>apps to piggyback custom permissions to the service.
>>
>>-Adrian
>
>
> In the meantime it's easy to add a permission in  ContactMechServices.xml
>
> Jacques
>
>
>>skip@theDevers wrote:
>>
>>
>>>There is a createPostalAddress in ContactMechServices.java
>>>
>>>There is also a simple one ContactMechServices.xml.
>>>
>>>In party services:
>>>
>>>    <service name="createPostalAddress" engine="simple"
>>>            location="org/ofbiz/party/contact/ContactMechServices.xml"
>>>invoke="createPostalAddress" auth="true">
>>>
>>>My question is why is there two and is there a way (beyond modifying the
>>>servicedef) to call the java guy?
>>>
>>>I like the java guy because it does a security check for _PCM_CREATE.
>>>
>>>Skip
>>>
>>>
>>
>

[wikitec]

Thanks BJ this is exactly what I needed

cheers

> -----Original Message-----
> From: BJ Freeman [mailto:[hidden email]]
> Sent: Saturday, 20 October 2007 1:28 AM
> To: [hidden email]
> Subject: Re: Security subnet firewall topology for ofbiz ecommerce?
>
> you can setup port access only.
> you can use port 80 for ofbiz.
> if you don't open Port 8443 on the router(firewall) then it can not be
> access via the internet. you can do this buy building the IP that can
> access port 8443.
>
> you can also setup the IP addresses in your router so only local IP's
> (192.168.*.* or 10.*.*.*) can access port 8443.
> I always recommend you have a router/firewall box that is seperate from
> your linux box.
>
> then do the same on your linux box.
>
>
> Philip Laing sent the following on 10/19/2007 6:17 AM:
> > Hi Guys
> > I am trying to get my head around a best practice for security for ofbiz
> > backoffice and security for ecommerce.  At this point in time I would
> like
> > to set ofbiz up so that public access cannot access backoffice database
> > information or only though pinholes or port forward (with different
> subnets)
> >
> > Has anyone gone through the logistics of setting up 2 x network
> interface
> > cards (nics) on a linux box with iptables so that the backoffice if
> isolated
> > from the front ecommerce web site?  Or better still, have an answer for
> my
> > question?
> >
> > I have been scrolling through posts I noticed skip wrote RE: POS
> Security -
> > web user interface? (New) By: Skip (skipdever) - 2007-10-12 08:33
> something
> > that caught my interest, but other than that I could not find much more
> the
> > subject.
> >
> > I have setup IPCop however it looks as though this will isolate my
> internal
> > network from ofbiz and will allow me to gain access through internet or
> KVM
> >
> > I would be very interested to hear your thoughts on this matter
> >
> > Thanks
> >
> > phil
> >
> >
> >
> >
> >

[Jacques Le Roux]

Hi Skip,

De : "skip@theDevers" <[hidden email]>

> Log into webtools.  Click on Party tab.  Click on "Find..." at the bottom
> with all the fields blank.  Select "DemoCustCompany" [Details]
>
> At the very bottom of the page, click "Create New" in the notes area.
>
> In the next screen, enter a noteId and note and click save at the bottom.
> You get this error:
>
> ...
> [noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>
> ....
>
> org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)
>
>
> If you look at the code referenced, you will note that if the "Note Id"
> field is left blank, the NoteData entry is created and everything works
> fine.
>
>
> It is my view that createPartyNote() should be modified to check to see if
> the NoteData exists if a noteId is passed and if not, one should be created
> or else the Note id field should be removed from (or passed as hidden) the
> note creation screen.

Yes I agree, this is a solution

> I don't actually understand why the user would be asked to enter a noteId
> anyway.

Maybe to allow user to set itself his/her notes number for recall later ? But then it should not be a primary key (which should be
generated) or it should be checked in code (as for Product for instance)

> I can fix this and submit a patch, but I wanted to be sure I wasn't missing
> something.

Please feel free to submit a patch

Thanks

Jacques

> Skip
>

[SkipDever]

Can someone tell me the svn command to create a patch?  If so, I'll submit
it today.


Skip

-----Original Message-----
From: Jacques Le Roux [mailto:[hidden email]]
Sent: Saturday, October 20, 2007 5:26 AM
To: [hidden email]
Subject: Re: Bug in add party notes


Hi Skip,

De : "skip@theDevers" <[hidden email]>

> Log into webtools.  Click on Party tab.  Click on "Find..." at the bottom
> with all the fields blank.  Select "DemoCustCompany" [Details]
>
> At the very bottom of the page, click "Create New" in the notes area.
>
> In the next screen, enter a noteId and note and click save at the bottom.
> You get this error:
>
> ...
>

[noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>
> ....
>
>
org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)
>
>
> If you look at the code referenced, you will note that if the "Note Id"
> field is left blank, the NoteData entry is created and everything works
> fine.
>
>
> It is my view that createPartyNote() should be modified to check to see if
> the NoteData exists if a noteId is passed and if not, one should be
created
> or else the Note id field should be removed from (or passed as hidden) the
> note creation screen.

Yes I agree, this is a solution

> I don't actually understand why the user would be asked to enter a noteId
> anyway.

Maybe to allow user to set itself his/her notes number for recall later ?
But then it should not be a primary key (which should be
generated) or it should be checked in code (as for Product for instance)

> I can fix this and submit a patch, but I wanted to be sure I wasn't
missing
> something.

Please feel free to submit a patch

Thanks

Jacques

> Skip
>

[BJ Freeman]

http://docs.ofbiz.org/display/OFBADMIN/OFBiz+Contributors+Best+Practices

skip@theDevers sent the following on 10/20/2007 10:17 AM:

> Can someone tell me the svn command to create a patch?  If so, I'll submit
> it today.
>
>
> Skip
>
> -----Original Message-----
> From: Jacques Le Roux [mailto:[hidden email]]
> Sent: Saturday, October 20, 2007 5:26 AM
> To: [hidden email]
> Subject: Re: Bug in add party notes
>
>
> Hi Skip,
>
> De : "skip@theDevers" <[hidden email]>
>> Log into webtools.  Click on Party tab.  Click on "Find..." at the bottom
>> with all the fields blank.  Select "DemoCustCompany" [Details]
>>
>> At the very bottom of the page, click "Create New" in the notes area.
>>
>> In the next screen, enter a noteId and note and click save at the bottom.
>> You get this error:
>>
>> ...
>>
> [noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
>> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
>> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>>
>> ....
>>
>>
> org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)
>>
>> If you look at the code referenced, you will note that if the "Note Id"
>> field is left blank, the NoteData entry is created and everything works
>> fine.
>>
>>
>> It is my view that createPartyNote() should be modified to check to see if
>> the NoteData exists if a noteId is passed and if not, one should be
> created
>> or else the Note id field should be removed from (or passed as hidden) the
>> note creation screen.
>
> Yes I agree, this is a solution
>
>> I don't actually understand why the user would be asked to enter a noteId
>> anyway.
>
> Maybe to allow user to set itself his/her notes number for recall later ?
> But then it should not be a primary key (which should be
> generated) or it should be checked in code (as for Product for instance)
>
>> I can fix this and submit a patch, but I wanted to be sure I wasn't
> missing
>> something.
>
> Please feel free to submit a patch
>
> Thanks
>
> Jacques
>
>> Skip
>>
>
>
>
>
>

[David E Jones]

There is some info in the Contributors Best Practices document (this  
is the doc for anyone who wants to contribute, mostly through Jira,  
etc):

http://docs.ofbiz.org/display/OFBADMIN/OFBiz+Contributors+Best+Practices

-David


On Oct 20, 2007, at 11:17 AM, skip@theDevers wrote:

> Can someone tell me the svn command to create a patch?  If so, I'll  
> submit
> it today.
>
>
> Skip
>
> -----Original Message-----
> From: Jacques Le Roux [mailto:[hidden email]]
> Sent: Saturday, October 20, 2007 5:26 AM
> To: [hidden email]
> Subject: Re: Bug in add party notes
>
>
> Hi Skip,
>
> De : "skip@theDevers" <[hidden email]>
>> Log into webtools.  Click on Party tab.  Click on "Find..." at the  
>> bottom
>> with all the fields blank.  Select "DemoCustCompany" [Details]
>>
>> At the very bottom of the page, click "Create New" in the notes area.
>>
>> In the next screen, enter a noteId and note and click save at the  
>> bottom.
>> You get this error:
>>
>> ...
>>
> [noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany
> (java.lang.Strin
>> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign  
>> key
>> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>>
>> ....
>>
>>
> org.ofbiz.party.party.PartyServices.createPartyNote
> (PartyServices.java:631)
>>
>>
>> If you look at the code referenced, you will note that if the  
>> "Note Id"
>> field is left blank, the NoteData entry is created and everything  
>> works
>> fine.
>>
>>
>> It is my view that createPartyNote() should be modified to check  
>> to see if
>> the NoteData exists if a noteId is passed and if not, one should be
> created
>> or else the Note id field should be removed from (or passed as  
>> hidden) the
>> note creation screen.
>
> Yes I agree, this is a solution
>
>> I don't actually understand why the user would be asked to enter a  
>> noteId
>> anyway.
>
> Maybe to allow user to set itself his/her notes number for recall  
> later ?
> But then it should not be a primary key (which should be
> generated) or it should be checked in code (as for Product for  
> instance)
>
>> I can fix this and submit a patch, but I wanted to be sure I wasn't
> missing
>> something.
>
> Please feel free to submit a patch
>
> Thanks
>
> Jacques
>
>> Skip
>>
>
>

[David E Jones]

Looks like we're on the same page BJ. ;)

-David


On Oct 20, 2007, at 11:21 AM, BJ Freeman wrote:

> http://docs.ofbiz.org/display/OFBADMIN/OFBiz+Contributors+Best 
> +Practices
>
> skip@theDevers sent the following on 10/20/2007 10:17 AM:
>> Can someone tell me the svn command to create a patch?  If so,  
>> I'll submit
>> it today.
>>
>>
>> Skip
>>
>> -----Original Message-----
>> From: Jacques Le Roux [mailto:[hidden email]]
>> Sent: Saturday, October 20, 2007 5:26 AM
>> To: [hidden email]
>> Subject: Re: Bug in add party notes
>>
>>
>> Hi Skip,
>>
>> De : "skip@theDevers" <[hidden email]>
>>> Log into webtools.  Click on Party tab.  Click on "Find..." at  
>>> the bottom
>>> with all the fields blank.  Select "DemoCustCompany" [Details]
>>>
>>> At the very bottom of the page, click "Create New" in the notes  
>>> area.
>>>
>>> In the next screen, enter a noteId and note and click save at the  
>>> bottom.
>>> You get this error:
>>>
>>> ...
>>>
>> [noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany
>> (java.lang.Strin
>>> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of  
>>> foreign key
>>> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>>>
>>> ....
>>>
>>>
>> org.ofbiz.party.party.PartyServices.createPartyNote
>> (PartyServices.java:631)
>>>
>>> If you look at the code referenced, you will note that if the  
>>> "Note Id"
>>> field is left blank, the NoteData entry is created and everything  
>>> works
>>> fine.
>>>
>>>
>>> It is my view that createPartyNote() should be modified to check  
>>> to see if
>>> the NoteData exists if a noteId is passed and if not, one should be
>> created
>>> or else the Note id field should be removed from (or passed as  
>>> hidden) the
>>> note creation screen.
>>
>> Yes I agree, this is a solution
>>
>>> I don't actually understand why the user would be asked to enter  
>>> a noteId
>>> anyway.
>>
>> Maybe to allow user to set itself his/her notes number for recall  
>> later ?
>> But then it should not be a primary key (which should be
>> generated) or it should be checked in code (as for Product for  
>> instance)
>>
>>> I can fix this and submit a patch, but I wanted to be sure I wasn't
>> missing
>>> something.
>>
>> Please feel free to submit a patch
>>
>> Thanks
>>
>> Jacques
>>
>>> Skip
>>>
>>
>>
>>
>>
>>

[BJ Freeman]

I am stubborn, but once I learn I don't forget.
:)

David E Jones sent the following on 10/20/2007 10:24 AM:

>
> Looks like we're on the same page BJ. ;)
>
> -David
>
>
> On Oct 20, 2007, at 11:21 AM, BJ Freeman wrote:
>
>> http://docs.ofbiz.org/display/OFBADMIN/OFBiz+Contributors+Best+Practices
>>
>> skip@theDevers sent the following on 10/20/2007 10:17 AM:
>>> Can someone tell me the svn command to create a patch?  If so, I'll
>>> submit
>>> it today.
>>>
>>>
>>> Skip
>>>
>>> -----Original Message-----
>>> From: Jacques Le Roux [mailto:[hidden email]]
>>> Sent: Saturday, October 20, 2007 5:26 AM
>>> To: [hidden email]
>>> Subject: Re: Bug in add party notes
>>>
>>>
>>> Hi Skip,
>>>
>>> De : "skip@theDevers" <[hidden email]>
>>>> Log into webtools.  Click on Party tab.  Click on "Find..." at the
>>>> bottom
>>>> with all the fields blank.  Select "DemoCustCompany" [Details]
>>>>
>>>> At the very bottom of the page, click "Create New" in the notes area.
>>>>
>>>> In the next screen, enter a noteId and note and click save at the
>>>> bottom.
>>>> You get this error:
>>>>
>>>> ...
>>>>
>>> [noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
>>>
>>>> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
>>>> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>>>>
>>>> ....
>>>>
>>>>
>>> org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)
>>>
>>>>
>>>> If you look at the code referenced, you will note that if the "Note Id"
>>>> field is left blank, the NoteData entry is created and everything works
>>>> fine.
>>>>
>>>>
>>>> It is my view that createPartyNote() should be modified to check to
>>>> see if
>>>> the NoteData exists if a noteId is passed and if not, one should be
>>> created
>>>> or else the Note id field should be removed from (or passed as
>>>> hidden) the
>>>> note creation screen.
>>>
>>> Yes I agree, this is a solution
>>>
>>>> I don't actually understand why the user would be asked to enter a
>>>> noteId
>>>> anyway.
>>>
>>> Maybe to allow user to set itself his/her notes number for recall
>>> later ?
>>> But then it should not be a primary key (which should be
>>> generated) or it should be checked in code (as for Product for instance)
>>>
>>>> I can fix this and submit a patch, but I wanted to be sure I wasn't
>>> missing
>>>> something.
>>>
>>> Please feel free to submit a patch
>>>
>>> Thanks
>>>
>>> Jacques
>>>
>>>> Skip
>>>>
>>>
>>>
>>>
>>>
>>>
>

[SkipDever]

Thanks BJ

I have looked at this 15 times and always stopped after reading the first
few lines of "How to Contriubte".  So much to read.

-----Original Message-----
From: BJ Freeman [mailto:[hidden email]]
Sent: Saturday, October 20, 2007 10:21 AM
To: [hidden email]
Subject: Re: How ot create a patch file?


http://docs.ofbiz.org/display/OFBADMIN/OFBiz+Contributors+Best+Practices

skip@theDevers sent the following on 10/20/2007 10:17 AM:

> Can someone tell me the svn command to create a patch?  If so, I'll submit
> it today.
>
>
> Skip
>
> -----Original Message-----
> From: Jacques Le Roux [mailto:[hidden email]]
> Sent: Saturday, October 20, 2007 5:26 AM
> To: [hidden email]
> Subject: Re: Bug in add party notes
>
>
> Hi Skip,
>
> De : "skip@theDevers" <[hidden email]>
>> Log into webtools.  Click on Party tab.  Click on "Find..." at the bottom
>> with all the fields blank.  Select "DemoCustCompany" [Details]
>>
>> At the very bottom of the page, click "Create New" in the notes area.
>>
>> In the next screen, enter a noteId and note and click save at the bottom.
>> You get this error:
>>
>> ...
>>
>

[noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
>> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
>> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>>
>> ....
>>
>>
>
org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)
>>
>> If you look at the code referenced, you will note that if the "Note Id"
>> field is left blank, the NoteData entry is created and everything works
>> fine.
>>
>>
>> It is my view that createPartyNote() should be modified to check to see
if
>> the NoteData exists if a noteId is passed and if not, one should be
> created
>> or else the Note id field should be removed from (or passed as hidden)
the

>> note creation screen.
>
> Yes I agree, this is a solution
>
>> I don't actually understand why the user would be asked to enter a noteId
>> anyway.
>
> Maybe to allow user to set itself his/her notes number for recall later ?
> But then it should not be a primary key (which should be
> generated) or it should be checked in code (as for Product for instance)
>
>> I can fix this and submit a patch, but I wanted to be sure I wasn't
> missing
>> something.
>
> Please feel free to submit a patch
>
> Thanks
>
> Jacques
>
>> Skip
>>
>
>
>
>
>

[BJ Freeman]

When I started we did not have the luxury of these documents.
but we all have to invest the time.
even the ones that answer you have had to.


skip@theDevers sent the following on 10/20/2007 11:00 AM:

> Thanks BJ
>
> I have looked at this 15 times and always stopped after reading the first
> few lines of "How to Contriubte".  So much to read.
>
> -----Original Message-----
> From: BJ Freeman [mailto:[hidden email]]
> Sent: Saturday, October 20, 2007 10:21 AM
> To: [hidden email]
> Subject: Re: How ot create a patch file?
>
>
> http://docs.ofbiz.org/display/OFBADMIN/OFBiz+Contributors+Best+Practices
>
> skip@theDevers sent the following on 10/20/2007 10:17 AM:
>> Can someone tell me the svn command to create a patch?  If so, I'll submit
>> it today.
>>
>>
>> Skip
>>
>> -----Original Message-----
>> From: Jacques Le Roux [mailto:[hidden email]]
>> Sent: Saturday, October 20, 2007 5:26 AM
>> To: [hidden email]
>> Subject: Re: Bug in add party notes
>>
>>
>> Hi Skip,
>>
>> De : "skip@theDevers" <[hidden email]>
>>> Log into webtools.  Click on Party tab.  Click on "Find..." at the bottom
>>> with all the fields blank.  Select "DemoCustCompany" [Details]
>>>
>>> At the very bottom of the page, click "Create New" in the notes area.
>>>
>>> In the next screen, enter a noteId and note and click save at the bottom.
>>> You get this error:
>>>
>>> ...
>>>
> [noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
>>> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
>>> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>>>
>>> ....
>>>
>>>
> org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)
>>> If you look at the code referenced, you will note that if the "Note Id"
>>> field is left blank, the NoteData entry is created and everything works
>>> fine.
>>>
>>>
>>> It is my view that createPartyNote() should be modified to check to see
> if
>>> the NoteData exists if a noteId is passed and if not, one should be
>> created
>>> or else the Note id field should be removed from (or passed as hidden)
> the
>>> note creation screen.
>> Yes I agree, this is a solution
>>
>>> I don't actually understand why the user would be asked to enter a noteId
>>> anyway.
>> Maybe to allow user to set itself his/her notes number for recall later ?
>> But then it should not be a primary key (which should be
>> generated) or it should be checked in code (as for Product for instance)
>>
>>> I can fix this and submit a patch, but I wanted to be sure I wasn't
>> missing
>>> something.
>> Please feel free to submit a patch
>>
>> Thanks
>>
>> Jacques
>>
>>> Skip
>>>
>>
>>
>>
>>
>
>
>
>

[SkipDever]

Done

I have submitted my first of what I hope to be many additions.

Skip

> -----Original Message-----
> From: BJ Freeman [mailto:[hidden email]]
> Sent: Saturday, October 20, 2007 10:21 AM
> To: [hidden email]
> Subject: Re: How ot create a patch file?
>
>
> http://docs.ofbiz.org/display/OFBADMIN/OFBiz+Contributors+Best+Practices
>
> skip@theDevers sent the following on 10/20/2007 10:17 AM:
>> Can someone tell me the svn command to create a patch?  If so, I'll

submit

>> it today.
>>
>>
>> Skip
>>
>> -----Original Message-----
>> From: Jacques Le Roux [mailto:[hidden email]]
>> Sent: Saturday, October 20, 2007 5:26 AM
>> To: [hidden email]
>> Subject: Re: Bug in add party notes
>>
>>
>> Hi Skip,
>>
>> De : "skip@theDevers" <[hidden email]>
>>> Log into webtools.  Click on Party tab.  Click on "Find..." at the

bottom
>>> with all the fields blank.  Select "DemoCustCompany" [Details]
>>>
>>> At the very bottom of the page, click "Create New" in the notes area.
>>>
>>> In the next screen, enter a noteId and note and click save at the
bottom.
>>> You get this error:
>>>
>>> ...
>>>
>
[noteId,DemoNote1(java.lang.String)][partyId,DemoCustCompany(java.lang.Strin
>>> g)] ... INSERT on table 'PARTY_NOTE' caused a violation of foreign key
>>> constraint 'PARTY_NOTE_NOTE' for key (DemoNote1).
>>>
>>> ....
>>>
>>>
>
org.ofbiz.party.party.PartyServices.createPartyNote(PartyServices.java:631)

>>> If you look at the code referenced, you will note that if the "Note Id"
>>> field is left blank, the NoteData entry is created and everything works
>>> fine.
>>>
>>>
>>> It is my view that createPartyNote() should be modified to check to see
> if
>>> the NoteData exists if a noteId is passed and if not, one should be
>> created
>>> or else the Note id field should be removed from (or passed as hidden)
> the
>>> note creation screen.
>> Yes I agree, this is a solution
>>
>>> I don't actually understand why the user would be asked to enter a

noteId

>>> anyway.
>> Maybe to allow user to set itself his/her notes number for recall later ?
>> But then it should not be a primary key (which should be
>> generated) or it should be checked in code (as for Product for instance)
>>
>>> I can fix this and submit a patch, but I wanted to be sure I wasn't
>> missing
>>> something.
>> Please feel free to submit a patch
>>
>> Thanks
>>
>> Jacques
>>
>>> Skip
>>>
>>
>>
>>
>>
>
>
>
>