checking access permissions based on data

[jonwimp]

In Widget screens, is there a way to check access permissions based on data?

For eg, a data row with field "ownerId" of value "MY_COMPANY" can be accessed (viewed) by users
associated with say a company named "MY_COMPANY", but cannot be viewed by users associated with
say a company named "OTHER_COMPANY". Is this possible inside Widget screens? I have a feeling this
is possible.

Jonathon

[Scott Gray]

Hi Jonathon

I haven't followed it closely but this should provide some info:
https://issues.apache.org/jira/browse/OFBIZ-609

Regards
Scott

On 22/06/07, Jonathon -- Improov <[hidden email]> wrote:

>
> In Widget screens, is there a way to check access permissions based on
> data?
>
> For eg, a data row with field "ownerId" of value "MY_COMPANY" can be
> accessed (viewed) by users
> associated with say a company named "MY_COMPANY", but cannot be viewed by
> users associated with
> say a company named "OTHER_COMPANY". Is this possible inside Widget
> screens? I have a feeling this
> is possible.
>
> Jonathon
>

[Jacopo Cappellato]

Jonathon,

have a look at the screen definition "CommonProductDecorator" in

applications/product/widget/catalog/CatalogCommonScreens.xml

I think it may be useful,

Jacopo


Jonathon -- Improov wrote:

> In Widget screens, is there a way to check access permissions based on
> data?
>
> For eg, a data row with field "ownerId" of value "MY_COMPANY" can be
> accessed (viewed) by users associated with say a company named
> "MY_COMPANY", but cannot be viewed by users associated with say a
> company named "OTHER_COMPANY". Is this possible inside Widget screens? I
> have a feeling this is possible.
>
> Jonathon

[Adrian Crum]

That's a great suggestion! I just used the service-based permissions for my calendar program and it
works great!

Scott Gray wrote:

> Hi Jonathon
>
> I haven't followed it closely but this should provide some info:
> https://issues.apache.org/jira/browse/OFBIZ-609
>
> Regards
> Scott
>
> On 22/06/07, Jonathon -- Improov <[hidden email]> wrote:
>
>>
>> In Widget screens, is there a way to check access permissions based on
>> data?
>>
>> For eg, a data row with field "ownerId" of value "MY_COMPANY" can be
>> accessed (viewed) by users
>> associated with say a company named "MY_COMPANY", but cannot be viewed by
>> users associated with
>> say a company named "OTHER_COMPANY". Is this possible inside Widget
>> screens? I have a feeling this
>> is possible.
>>
>> Jonathon
>>
>

[jonwimp]

Adrian, Scott,

Do you mean using secas?

Currently, I am doing it with services too, but called from simple methods.

Typical flow:

1. <request-map> has an event (simple method) that does some work

2. Event codes first calls a permissions service, which checks all kinds of DB
    values, ownership tags, etc.

3. Event codes may, depending on permissions check, return with a "noperm"
    response code or continue execution and finally return a "success" code.

4. <request-map> has 2 views to cater for the "success" and the "failure"
    conditions. "Failure" conditions all go to a generic failure screen which
    displays the error message (eg, "you do not have permissions to do that!").


Jonathon

Adrian Crum wrote:

> That's a great suggestion! I just used the service-based permissions for
> my calendar program and it works great!
>
> Scott Gray wrote:
>> Hi Jonathon
>>
>> I haven't followed it closely but this should provide some info:
>> https://issues.apache.org/jira/browse/OFBIZ-609
>>
>> Regards
>> Scott
>>
>> On 22/06/07, Jonathon -- Improov <[hidden email]> wrote:
>>
>>>
>>> In Widget screens, is there a way to check access permissions based on
>>> data?
>>>
>>> For eg, a data row with field "ownerId" of value "MY_COMPANY" can be
>>> accessed (viewed) by users
>>> associated with say a company named "MY_COMPANY", but cannot be
>>> viewed by
>>> users associated with
>>> say a company named "OTHER_COMPANY". Is this possible inside Widget
>>> screens? I have a feeling this
>>> is possible.
>>>
>>> Jonathon
>>>
>>
>
>

[Adrian Crum]

Jonathon,

I was referring to the <permission-service> element. Take a look at
framework/example/servicedef/services.xml.

-Adrian

Jonathon -- Improov wrote:

> Adrian, Scott,
>
> Do you mean using secas?
>
> Currently, I am doing it with services too, but called from simple methods.
>
> Typical flow:
>
> 1. <request-map> has an event (simple method) that does some work
>
> 2. Event codes first calls a permissions service, which checks all kinds
> of DB
>    values, ownership tags, etc.
>
> 3. Event codes may, depending on permissions check, return with a "noperm"
>    response code or continue execution and finally return a "success" code.
>
> 4. <request-map> has 2 views to cater for the "success" and the "failure"
>    conditions. "Failure" conditions all go to a generic failure screen
> which
>    displays the error message (eg, "you do not have permissions to do
> that!").
>
>
> Jonathon
>
> Adrian Crum wrote:
>
>> That's a great suggestion! I just used the service-based permissions
>> for my calendar program and it works great!
>>
>> Scott Gray wrote:
>>
>>> Hi Jonathon
>>>
>>> I haven't followed it closely but this should provide some info:
>>> https://issues.apache.org/jira/browse/OFBIZ-609
>>>
>>> Regards
>>> Scott
>>>
>>> On 22/06/07, Jonathon -- Improov <[hidden email]> wrote:
>>>
>>>>
>>>> In Widget screens, is there a way to check access permissions based on
>>>> data?
>>>>
>>>> For eg, a data row with field "ownerId" of value "MY_COMPANY" can be
>>>> accessed (viewed) by users
>>>> associated with say a company named "MY_COMPANY", but cannot be
>>>> viewed by
>>>> users associated with
>>>> say a company named "OTHER_COMPANY". Is this possible inside Widget
>>>> screens? I have a feeling this
>>>> is possible.
>>>>
>>>> Jonathon
>>>>
>>>
>>
>>
>
>

[jonwimp]

I see. Thanks.

Jonathon

Adrian Crum wrote:

> Jonathon,
>
> I was referring to the <permission-service> element. Take a look at
> framework/example/servicedef/services.xml.
>
> -Adrian
>
> Jonathon -- Improov wrote:
>> Adrian, Scott,
>>
>> Do you mean using secas?
>>
>> Currently, I am doing it with services too, but called from simple
>> methods.
>>
>> Typical flow:
>>
>> 1. <request-map> has an event (simple method) that does some work
>>
>> 2. Event codes first calls a permissions service, which checks all
>> kinds of DB
>>    values, ownership tags, etc.
>>
>> 3. Event codes may, depending on permissions check, return with a
>> "noperm"
>>    response code or continue execution and finally return a "success"
>> code.
>>
>> 4. <request-map> has 2 views to cater for the "success" and the "failure"
>>    conditions. "Failure" conditions all go to a generic failure screen
>> which
>>    displays the error message (eg, "you do not have permissions to do
>> that!").
>>
>>
>> Jonathon
>>
>> Adrian Crum wrote:
>>
>>> That's a great suggestion! I just used the service-based permissions
>>> for my calendar program and it works great!
>>>
>>> Scott Gray wrote:
>>>
>>>> Hi Jonathon
>>>>
>>>> I haven't followed it closely but this should provide some info:
>>>> https://issues.apache.org/jira/browse/OFBIZ-609
>>>>
>>>> Regards
>>>> Scott
>>>>
>>>> On 22/06/07, Jonathon -- Improov <[hidden email]> wrote:
>>>>
>>>>>
>>>>> In Widget screens, is there a way to check access permissions based on
>>>>> data?
>>>>>
>>>>> For eg, a data row with field "ownerId" of value "MY_COMPANY" can be
>>>>> accessed (viewed) by users
>>>>> associated with say a company named "MY_COMPANY", but cannot be
>>>>> viewed by
>>>>> users associated with
>>>>> say a company named "OTHER_COMPANY". Is this possible inside Widget
>>>>> screens? I have a feeling this
>>>>> is possible.
>>>>>
>>>>> Jonathon
>>>>>
>>>>
>>>
>>>
>>
>>
>
>

[Mathius Allo]

Hi All,
   
  I have a quick question on how to manually order the module appear on the app-bar? It looks like that it is sorted based on the module name.
   
  i.e. I would like to display "Home" before "Example" from left to right.
   
  Cheers,
  Mathius

 
---------------------------------
Expecting? Get great news right away with email Auto-Check.
Try the Yahoo! Mail Beta.

[Goh Hong]

When you mean by module name does that mean if Home is set to Zome it will
shift to the extreme right?
Does it relates to the order in the xml file if any?

Regards
Goh


On 6/26/07, Mathius Allo <[hidden email]> wrote:

>
> Hi All,
>
> I have a quick question on how to manually order the module appear on the
> app-bar? It looks like that it is sorted based on the module name.
>
> i.e. I would like to display "Home" before "Example" from left to right.
>
> Cheers,
> Mathius
>
>
> ---------------------------------
> Expecting? Get great news right away with email Auto-Check.
> Try the Yahoo! Mail Beta.

[Mathius Allo]

Hi Goh,
 
It seems to be not related to the order entry in the component-load.xml under <Ofbiz>\application folder.
   
  Thanks in advanced.
   
  Mathius.
 
Goh Hong <[hidden email]> wrote:
  When you mean by module name does that mean if Home is set to Zome it will
shift to the extreme right?
Does it relates to the order in the xml file if any?

Regards
Goh


On 6/26/07, Mathius Allo wrote:

>
> Hi All,
>
> I have a quick question on how to manually order the module appear on the
> app-bar? It looks like that it is sorted based on the module name.
>
> i.e. I would like to display "Home" before "Example" from left to right.
>
> Cheers,
> Mathius
>
>
> ---------------------------------
> Expecting? Get great news right away with email Auto-Check.
> Try the Yahoo! Mail Beta.

       
---------------------------------
Pinpoint customers who are looking for what you sell.