PUBLIC - Liferay Portal Community Edition

Adding an Organization with an admin with limited permissions may cause the admin to not be allowed to edit the org after creation

Details

  • Branch Version/s:
    6.1.x, 6.0.x
  • Backported to Branch:
    Committed
  • Fix Priority:
    4
  • Similar Issues:
    Show 4 results 

Description

1 Create a new role named Test.
2 Define permission for "Test", User selects General under Portal from the Add Permissions drop down list, check Add Organization under General then Save.
3 User select all permission under Control Panel: Portal->Users and Organizations.View in Organization under General->Users and Organizations.
4 Create a new user only with role Test.
5 Login as new user.
6 Go to Control Panel->Click Users and Organizations.
7 User add an organization and Save.

You will get an error: You do not have the required permissions.
Click Users and Organizations again, you can't find the organization you had added.

Issue Links

causes

Regression Bug - Used by Liferay QA to indicate an issue discovered during regression testing LPS-27214 Organization Roles are not clickable on pop-up in User Information

  • Minor - Minor loss of function, or other problem where easy workaround is present.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Sharry Shi added a comment -

I can still reproduce this error on
Tomcat 7.0 + MySQL 5. 6.1.10 GIT ID: 14a09cf0fb3757523c9bf935178d36a96ce9f48b.

Show
Sharry Shi added a comment - I can still reproduce this error on Tomcat 7.0 + MySQL 5. 6.1.10 GIT ID: 14a09cf0fb3757523c9bf935178d36a96ce9f48b.
Hide
Permalink
Jorge Ferrer added a comment -

The solution to this problem is to automatically assign the "Organization Owner" role to the user who created the organization even if he does not belong to the organization (since that depends on a property that is false by default). This role will be shown in the "Roles" section when editing the user account so that it can be removed at any later time if desired.

It is worth noting that the organization administration UI will still require a user to belong to an org in order to give him an org role on it.

Show
Jorge Ferrer added a comment - The solution to this problem is to automatically assign the "Organization Owner" role to the user who created the organization even if he does not belong to the organization (since that depends on a property that is false by default). This role will be shown in the "Roles" section when editing the user account so that it can be removed at any later time if desired. It is worth noting that the organization administration UI will still require a user to belong to an org in order to give him an org role on it.
Hide
Permalink
Jorge Ferrer added a comment -

I had a conversation with Zsolt about this and we found a better solution that doesn't have some issues we have found with the one I described in the previous comment.

The solution can be described by the following points:

  • In order to be an Org Admin or Org Owner the user must always belong to the organization (there must be an entry in Orgs_Users)
  • If a user is an Org Owner of an organization his profile cannot be edited and he cannot be impersonated by any other Org Owner or Org Admin
  • If a user is an Org Admin of an organization his profile cannot be edited and he cannot be impersonated by any other Org Admin, but it can be done by an Org Owner

Zsolt is working in implementing this.

Show
Jorge Ferrer added a comment - I had a conversation with Zsolt about this and we found a better solution that doesn't have some issues we have found with the one I described in the previous comment. The solution can be described by the following points: In order to be an Org Admin or Org Owner the user must always belong to the organization (there must be an entry in Orgs_Users) If a user is an Org Owner of an organization his profile cannot be edited and he cannot be impersonated by any other Org Owner or Org Admin If a user is an Org Admin of an organization his profile cannot be edited and he cannot be impersonated by any other Org Admin, but it can be done by an Org Owner Zsolt is working in implementing this.
Hide
Permalink
Jorge Ferrer added a comment -

A solution to this ticket has been submitted, but please DO NOT BACKPORT IT OR CLOSE THE TICKET YET.

We need to think through the right way to backport this.

Show
Jorge Ferrer added a comment - A solution to this ticket has been submitted, but please DO NOT BACKPORT IT OR CLOSE THE TICKET YET. We need to think through the right way to backport this.
Hide
Permalink
Michael Saechang added a comment -

Committed on:
6.1.x GIT ID: 0c8c38cb471391d51d493e91a191b7f4bafa9b7d.
6.2.x GIT ID: cf5e3405f0da85c9d75192c8a01727012d1e9d2e.

Show
Michael Saechang added a comment - Committed on: 6.1.x GIT ID: 0c8c38cb471391d51d493e91a191b7f4bafa9b7d. 6.2.x GIT ID: cf5e3405f0da85c9d75192c8a01727012d1e9d2e.
Hide
Permalink
Jorge Ferrer added a comment -

I have sent the solution for review. The review should be pretty straight forward except for the changes to UserServiceImpl since the existing code has been simplified a lot and it is surprising at first. Both Zsolt and myself have done a lot of tests to guarantee that the new code works like the old one.

Show
Jorge Ferrer added a comment - I have sent the solution for review. The review should be pretty straight forward except for the changes to UserServiceImpl since the existing code has been simplified a lot and it is surprising at first. Both Zsolt and myself have done a lot of tests to guarantee that the new code works like the old one.
Hide
Permalink
Michael Saechang added a comment -

Committed on:
Portal 6.2.x GIT ID: cbc90841505585fb5748efbe1cf578450f28698a.

Show
Michael Saechang added a comment - Committed on: Portal 6.2.x GIT ID: cbc90841505585fb5748efbe1cf578450f28698a.
Hide
Permalink
Sharry Shi added a comment -

PASSED Manual Testing following the steps in the description.

Fixed on:
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: 8af4409f683a15b59f089fdf14cca0fb26e3a0a1.

User can create the organization successfully.

Show
Sharry Shi added a comment - PASSED Manual Testing following the steps in the description. Fixed on: Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: 8af4409f683a15b59f089fdf14cca0fb26e3a0a1. User can create the organization successfully.
Hide
Permalink
Michael Saechang added a comment -

Thank you Sharry for testing. Closing as 'Fixed'.

Show
Michael Saechang added a comment - Thank you Sharry for testing. Closing as 'Fixed'.
Hide
Permalink
Sharry Shi added a comment -

PASSED Manual Testing following the steps in the description.

Fixed on:
Tomcat 7.0 + MySQL 5. Portal 6.1.x.EE GIT ID: 0c6bc6dd8d1e9b4bf14f1b513130dda75da9bcd0.
Tomcat 6.0 + MySQL 5. Portal 6.0.x GIT ID: f81c1ed3ba96872c7bc6713618e2c72903c387a5.

User can create the organization successfully.

Show
Sharry Shi added a comment - PASSED Manual Testing following the steps in the description. Fixed on: Tomcat 7.0 + MySQL 5. Portal 6.1.x.EE GIT ID: 0c6bc6dd8d1e9b4bf14f1b513130dda75da9bcd0. Tomcat 6.0 + MySQL 5. Portal 6.0.x GIT ID: f81c1ed3ba96872c7bc6713618e2c72903c387a5. User can create the organization successfully.
Hide
Permalink
Michael Saechang added a comment -

Thank you Sharry for testing. Closing as 'Fixed'.

Show
Michael Saechang added a comment - Thank you Sharry for testing. Closing as 'Fixed'.

People

Vote (0)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved:
    Days since last comment:
    38 weeks, 1 day ago