In OFBiz there is no external security configuration so each screen and service is responsible for checking its own security constraints.
You'll see examples all over in service defs, and in screen defs (especially in decorators to have the same permission for a set of screens, ie look in the CommonScreens.xml files). -David On Jul 25, 2011, at 11:19 AM, Mansour Al Akeel wrote: > David, > thank you for your help. I will try it later on tonight. I still don't > understand how would modifying a "View" screen, prevent accessing the > task using the URL, but I will try your advice first, and will let you know > how it went. > > Thank you. > > > On Mon Jul 25,2011 09:53 am, David E Jones wrote: >> >> On Jul 25, 2011, at 9:50 AM, Mansour Al Akeel wrote: >> >>> Thank you David. >>> This is what I wanted to know. If it's a configuration issue or >>> something has to change in the code. It looks that I need to do both. >>> Please see my comments. >>> >>> On Mon Jul 25,2011 07:40 am, David E Jones wrote: >>>> >>>> Mansour, >>>> >>>> You could look at the data preparation code for that screen (typically in >>>> the screen.actions element of the screen definition) to see if it does any >>>> sort of "permission-esque" filtering. Chances are it does not and the >>>> search criteria used are the only criteria passed included in the database >>>> query. >>>> >>>> In other words, it sounds like you're looking for a feature that does not >>>> exist. It could certainly be implemented by: >>>> >>>> 1. adding the permission-related constraints to the FindTask query >>>> 2. changing the view task screen to check the same constraint(s) for the >>>> individual task >>>> >>> >>> Would this still prevent access to individual tasks through the URL ? >>> I think this would only hide the tasks in the search results. >> >> Item #2 that I mentioned above is meant to take care of that. >> >> -David >>
