David, Thank you a lot. I misunderstood some parts, and now it all make sense to me. I believe hiding task from parties that are not members of the project, should be the default behavior. If you agree with me, I will create a JIRA issue, and submitt a patch when available.
Appreciate your help. On Mon Jul 25,2011 11:57 am, David E Jones wrote: > > In OFBiz there is no external security configuration so each screen and > service is responsible for checking its own security constraints. > > You'll see examples all over in service defs, and in screen defs (especially > in decorators to have the same permission for a set of screens, ie look in > the CommonScreens.xml files). > > -David > > > On Jul 25, 2011, at 11:19 AM, Mansour Al Akeel wrote: > > > David, > > thank you for your help. I will try it later on tonight. I still don't > > understand how would modifying a "View" screen, prevent accessing the > > task using the URL, but I will try your advice first, and will let you know > > how it went. > > > > Thank you. > > > > > > On Mon Jul 25,2011 09:53 am, David E Jones wrote: > >> > >> On Jul 25, 2011, at 9:50 AM, Mansour Al Akeel wrote: > >> > >>> Thank you David. > >>> This is what I wanted to know. If it's a configuration issue or > >>> something has to change in the code. It looks that I need to do both. > >>> Please see my comments. > >>> > >>> On Mon Jul 25,2011 07:40 am, David E Jones wrote: > >>>> > >>>> Mansour, > >>>> > >>>> You could look at the data preparation code for that screen (typically > >>>> in the screen.actions element of the screen definition) to see if it > >>>> does any sort of "permission-esque" filtering. Chances are it does not > >>>> and the search criteria used are the only criteria passed included in > >>>> the database query. > >>>> > >>>> In other words, it sounds like you're looking for a feature that does > >>>> not exist. It could certainly be implemented by: > >>>> > >>>> 1. adding the permission-related constraints to the FindTask query > >>>> 2. changing the view task screen to check the same constraint(s) for the > >>>> individual task > >>>> > >>> > >>> Would this still prevent access to individual tasks through the URL ? > >>> I think this would only hide the tasks in the search results. > >> > >> Item #2 that I mentioned above is meant to take care of that. > >> > >> -David > >> >
