Security issue with viewable / accessible

Classic Servoy
1

I have migrated a solution from 3.5 to 5.2 recently, and now none of my previously hidden elements (mostly buttons) are showing when they are designated not visible in security (the tickbox is NOT ticked for viewable).

I have 16 security groups. One button on a navigator, and two buttons on a regular form show for all users even though they are supposed to be only visible to the Administrators group, i.e. I have deselected the tick in the viewable tickbox for every group other than Administrators for that named element. See attached screenshot of one example group. The only group that DOES have viewable ticked is Administrators, yet the button is permanently visible…

Odd thing is that if I make it visible but not accessible for one of the groups, it becomes non accessible for ALL groups - including Administrators.

I have tried deleting and re-adding the button, as well as naming it differently.

There are no regular users in the Administrators group and all them are assigned to at least one or two of the other non Administrator groups.

I am using Mac / Java 1.6 / Servoy 5.2 / Sybase 11.

Has something else changed with 5.2 that I don’t know about with regard to making elements invisible? Is this a bug?

Thanks for any help
Bevil

Screen shot 2010-11-10 at 11.22.23.png
Screen shot 2010-11-10 at 11.22.23.png1279×868 113 KB

2

Are there any errors reported in “Problems” View?

3

Hi Andrei

After exhaustively removing warnings (you can only see 100 at a time), I have got down to below 100 and have found that there is no issue shown for that element, or form.

I set the property to not viewable for a particular group, log in as someone in that group, and the button is there… This happens with several buttons.

Any help would be appreciated

Bevil

4

can you just place a button in the form where you
have a field set to non-viewable, and on click just do:
application.output(security.getUserName());
application.output(security.getUserGroups());
application.output(security.getElementUUIDs(‘your_form_name’));
, so we first check who is logged in and what elements do we have, and then attach here the output, along with the
form security file, the file with the same name as the form, but with “sec” as extension, so we can see what are the security settings on the form’s elements

5

Output from Servoy when I press the button (which is supposed to be hidden)

bevil
BufferedDataSet {Columnnames[group_id, group_name]}
row_1[1, Administrators]
BufferedDataSet {Columnnames[name, uuid]}
row_1[null, 22bf3de2-7dfc-4583-bb80-9ee348cf436d]
row_2[database_button, 2ad6d61d-c307-49a9-bab0-c7eece6f4d19]
row_3[security_admin_button, 7A3AD48C-AC71-4C54-AC40-5C59792E79FA]
row_4[lbl_test, 7C28A7FE-35ED-4E1E-B211-58F4FC66E728]
row_5[archives_chooser, 8de515ee-f311-4931-8e6f-41164b64d940]
row_6[purchase_order_chooser, D4B723E0-BA6E-4326-9634-34DC9A6772EB]
row_7[image_library_typec, ad4fa1b6-0495-4b75-a337-51b548c489ad]

Attached is the sec file (although I have had to change its extension to txt as the forum won’t allow .sec files as attachments).

navigator_splash.txt (1.39 KB)

6

Thunder:
Output from Servoy when I press the button (which is supposed to be hidden)

bevil
BufferedDataSet {Columnnames[group_id, group_name]}
row_1[1, Administrators]
BufferedDataSet {Columnnames[name, uuid]}
row_1[null, 22bf3de2-7dfc-4583-bb80-9ee348cf436d]
row_2[database_button, 2ad6d61d-c307-49a9-bab0-c7eece6f4d19]
row_3[security_admin_button, 7A3AD48C-AC71-4C54-AC40-5C59792E79FA]
row_4[lbl_test, 7C28A7FE-35ED-4E1E-B211-58F4FC66E728]
row_5[archives_chooser, 8de515ee-f311-4931-8e6f-41164b64d940]
row_6[purchase_order_chooser, D4B723E0-BA6E-4326-9634-34DC9A6772EB]
row_7[image_library_typec, ad4fa1b6-0495-4b75-a337-51b548c489ad]

Attached is the sec file (although I have had to change its extension to txt as the forum won’t allow .sec files as attachments).

from this it seems that “bevil” is in the “Administrators” group, and it has “viewable” rights on all elements

7

This is the output if I log in as a NON administrator (although I have named him Administrator, he is not in the administrators group…)

Administrator
BufferedDataSet {Columnnames[group_id, group_name]}
row_1[14, studios]
BufferedDataSet {Columnnames[name, uuid]}
row_1[null, 22bf3de2-7dfc-4583-bb80-9ee348cf436d]
row_2[database_button, 2ad6d61d-c307-49a9-bab0-c7eece6f4d19]
row_3[security_admin_button, 7A3AD48C-AC71-4C54-AC40-5C59792E79FA]
row_4[lbl_test, 7C28A7FE-35ED-4E1E-B211-58F4FC66E728]
row_5[archives_chooser, 8de515ee-f311-4931-8e6f-41164b64d940]
row_6[purchase_order_chooser, D4B723E0-BA6E-4326-9634-34DC9A6772EB]
row_7[image_library_typec, ad4fa1b6-0495-4b75-a337-51b548c489ad]

8

are you sure you don’t make those elements visible from code ?
can you create a new dummy form, and put there an element without “viewable” right, and
test if it shows up ?
if you still see the issue, the best would be if you create a case in our support system, and
upload your solution, so we can debug it, as with a simple test solution everything works as expected

9

Bevil,

We found the issue, this is fixed in 5.2.3.

Rob

10

Ahhhhhhhhhhhhhhh!!

Thank goodness, I thought I was going nuts.

Bevil