[
https://issues.apache.org/jira/browse/OFBIZ-12739?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17656245#comment-17656245
]
Daniel Watford commented on OFBIZ-12739:
----------------------------------------
Issue is caused by a typo in ProductServices.groovy:
Line 555:
{quote}security.hasEntityPermission(parameters.alternatePermissionRoot,
checkAction, parameters.userLogin)))) {
{quote}
should be replaced with:
{quote}security.hasEntityPermission(parameters.alternatePermissionRoot,
"_${checkAction}", parameters.userLogin)))) {
{quote}
The checkAction argument is missing the underscore prefix.
> Permissions: Cannot create product facility when granted FACILITY_CREATE
> permission
> -----------------------------------------------------------------------------------
>
> Key: OFBIZ-12739
> URL: https://issues.apache.org/jira/browse/OFBIZ-12739
> Project: OFBiz
> Issue Type: Bug
> Components: product
> Affects Versions: 22.01.01
> Reporter: Daniel Watford
> Priority: Major
> Fix For: 22.01.01
>
>
> A new user was created and granted the following permissions:
> * OFBTOOLS_VIEW
> * FACILITY_VIEW
> * FACILITY_UPDATE
> * FACILITY_CREATE
> * CATALOG_VIEW
> User can navigate to the Catalog webapp and can select a product, e.g.
> [https://demo-next.ofbiz.apache.org/catalog/control/EditProduct?productId=WG-9943]
> User then clicks on the Facilities button, enters details for a facility and
> clicks the Add button.
> The following error is displayed:
> {quote}You haven't the permission for the service createProductFacility,
> reason : Access refused
> {quote}
>
> The createProductFacility service uses permission-service,
> checkProductFacilityRelatedPermission. This permission-service request
> permission checking via another service, checkProductRelatedPermission,
> passing FACILITY as an alternative permission root.
> This alternative permission route is the reason why the user's current set of
> permissions are expected to allow the createProductFacility service to run.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
