[
https://issues.apache.org/jira/browse/FINERACT-2720?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Foo Developer updated FINERACT-2720:
------------------------------------
External issue URL: https://github.com/apache/fineract/pull/6197
> Office Dropdown Displays “All” and Unauthorized Branches Instead of Current
> Office Hierarchy
> --------------------------------------------------------------------------------------------
>
> Key: FINERACT-2720
> URL: https://issues.apache.org/jira/browse/FINERACT-2720
> Project: Apache Fineract
> Issue Type: Bug
> Components: System
> Reporter: Foo Developer
> Assignee: Foo Developer
> Priority: Major
>
> When the "All" option is selected in the Office dropdown on the
> Entity-to-Entity Mapping screen
>
> (System → Entity to Entity Mapping), the API (GET
> /v1/entitytoentitymapping/\{mapId}) returns
>
> mappings for all offices in the system, including offices outside the
> authenticated user's
>
> hierarchy. The dropdown should restrict results to the user's own office
> and its descendants.
>
>
>
>
> *Root cause*: In
> \{{FineractEntityAccessReadServiceImpl.retrieveEntityToEntityMappings}},
>
>
> \{{fromId = 0}} (the "All" sentinel) is passed through to the SQL as-is,
> returning every row
>
> regardless of the caller's office hierarchy.
>
>
>
>
>
> *Fix*: When \{{fromId == 0}} and the relation's \{{from_entity_type}} is
> office (type 1),
>
> use a recursive CTE to scope the result set to the authenticated user's
> office and its
>
> descendants only. Non-office relation types are unaffected.
>
>
>
>
>
> *Affected file*:
>
>
>
> \{{fineract-provider/.../entityaccess/service/FineractEntityAccessReadServiceImpl.java}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
