CMDBuild Forum

Multiple update does not check for user's permissions

Old Versions
#1

Hi all, we’ve found what would seem to be a bug.

We assigned "Read" permissions for a user on all CIs.
However, if that user goes to Utility > Multiple udpate, he will be able to edit cards he's not supposed to be allowed to modify.
From my perspective, multiple update should not let users modify cards if they don't have "Write" permissions on the cards he/she is trying to edit.
Is this a know issue in CMDBuild 2.3.4?
Has this been fixed in newer versions?
Thanks.
#2

Yes, it’s a known bug.

Usually the massive edit function is used by particular users who do not have permission restrictions, and this reduces the impact of the bug.
If necessary, the Multiple Update function can be disabled by the Administration Module (User and Groups => UI Configuration => Utility - Multiple update).
The bug will be corrected in the CMDBuild 3.0 version (release scheduled for early next year).
CMDBuild Team
#3

Previously Tecnoteca wrote:

Yes, it's a known bug.
Usually the massive edit function is used by particular users who do not have permission restrictions, and this reduces the impact of the bug.
If necessary, the Multiple Update function can be disabled by the Administration Module (User and Groups => UI Configuration => Utility - Multiple update).
The bug will be corrected in the CMDBuild 3.0 version (release scheduled for early next year).
CMDBuild Team

 

Ok, thanks for your response.
We'll be waiting for CMDBuild v3.0.