Editable data grid columns bypass entity access rules XPath constraint

5
Hi All, I have an entity with XPath constraint that handles the read/write access. So all works perfectly fine on a data view or list view and I can read / write the attributes as expected. The issue is on a data grid, I have 6-7 columns on the grid that are set to be editable and I expected that entity access will handle everything and will not allow those columns to be editable if I only have read access based on my XPath constraint but unfortunately the columns are still editable. I can enter a different value and the grid is refreshed in client side but the application is unresponsive until I refresh my browser. In the console I get errors which I can understand why (rollback of chages due to secutiry reasons), please see the error below. I have to keep those columns on the grid editable and I thought of creating multiple grids on same page and make required columns editable on a grid based on selection and add visibility on those grids but this work-around doesn't look a good solution to me. Does anyone had this similar requirement and if yes how did you handled it? If no then please can you suggest what will be the best solution to this? Is it possible to handle this at all or is this a data grid bug as it does not listen to entity access rules XPath constraint?   com.mendix.core.CoreRuntimeException: com.mendix.systemwideinterfaces.MendixRuntimeException: com.mendix.core.CoreRuntimeException: Exception occurred in action '{"changes":"{Attribute=0}","type":"ChangeAction"}', all database changes executed by this action were rolled back at com.mendix.core.actionmanagement.ActionManager.executeSync(ActionManager.java:176) Caused by: com.mendix.systemwideinterfaces.MendixRuntimeException: com.mendix.core.CoreRuntimeException: Exception occurred in action '{"changes":"{Attribute=0}","type":"ChangeAction"}', all database changes executed by this action were rolled back at com.mendix.util.classloading.Runner.doRunUsingClassLoaderOf(Runner.java:40) Caused by: com.mendix.core.CoreRuntimeException: Exception occurred in action '{"changes":"{Attribute=0}","type":"ChangeAction"}', all database changes executed by this action were rolled back at com.mendix.core.actionmanagement.CoreAction.processErrorState(CoreAction.java:303) Caused by: com.mendix.systemwideinterfaces.MendixRuntimeException: Changing member 'Attribute' of 'Test.Entity' by user mohammed failed for security reasons: Write access denied for member 'Attribute' of object 'Test.Entity' at com.mendix.core.action.user.Changer$class.changeMember(Changer.scala:41) Caused by: com.mendix.core.objectmanagement.SecurityRuntimeException: Write access denied for member 'Attribute' of object 'Test.Entity' at com.mendix.core.objectmanagement.MendixObjectMemberImpl.checkWriteAccess(MendixObjectMemberImpl.java:146) at com.mendix.core.objectmanagement.MendixObjectMemberImpl.setValue(MendixObjectMemberImpl.java:219) at com.mendix.core.objectmanagement.member.internal.MendixDecimalImpl.setValue(MendixDecimalImpl.scala:21) at com.mendix.core.objectmanagement.member.internal.MendixDecimalImpl.setValue(MendixDecimalImpl.scala:10) at com.mendix.core.objectmanagement.MendixObjectMemberImpl.parseValueFromString(MendixObjectMemberImpl.java:244) at com.mendix.core.action.user.Changer$class.setMemberValue(Changer.scala:59) at com.mendix.core.action.user.Changer$class.changeMember(Changer.scala:29) at com.mendix.core.action.user.ChangeAction.changeMember(ChangeAction.scala:10) at com.mendix.core.action.user.ChangeAction$$anonfun$executeAction$1.apply(ChangeAction.scala:32) at com.mendix.core.action.user.ChangeAction$$anonfun$executeAction$1.apply(ChangeAction.scala:31) at scala.collection.Iterator$class.foreach(Iterator.scala:742) at scala.collection.AbstractIterator.foreach(Iterator.scala:1194) at scala.collection.IterableLike$class.foreach(IterableLike.scala:72) at scala.collection.AbstractIterable.foreach(Iterable.scala:54) at com.mendix.core.action.user.ChangeAction.executeAction(ChangeAction.scala:31) at com.mendix.core.action.user.ChangeAction.executeAction(ChangeAction.scala:10) at com.mendix.systemwideinterfaces.core.UserAction.execute(UserAction.java:49) at com.mendix.core.actionmanagement.CoreAction.doCall(CoreAction.java:260) at com.mendix.core.actionmanagement.CoreAction.call(CoreAction.java:248) at com.mendix.core.actionmanagement.ActionManager$1.execute(ActionManager.java:168) at com.mendix.util.classloading.Runner.doRunUsingClassLoaderOf(Runner.java:36) at com.mendix.core.actionmanagement.ActionManager.executeSync(ActionManager.java:172) at com.mendix.core.component.InternalCore.change(InternalCore.java:123) at com.mendix.webui.requesthandling.ChangesHandling$$anonfun$validateChanges$1$$anonfun$3.apply(ChangesHandling.scala:28) at com.mendix.webui.requesthandling.ChangesHandling$$anonfun$validateChanges$1$$anonfun$3.apply(ChangesHandling.scala:21) at scala.collection.TraversableLike$WithFilter$$anonfun$map$2.apply(TraversableLike.scala:728) at scala.collection.immutable.Map$Map1.foreach(Map.scala:116) at scala.collection.TraversableLike$WithFilter.map(TraversableLike.scala:727) at com.mendix.webui.requesthandling.ChangesHandling$$anonfun$validateChanges$1.apply(ChangesHandling.scala:21) at com.mendix.webui.requesthandling.ChangesHandling$$anonfun$validateChanges$1.apply(ChangesHandling.scala:17) at scala.Option.map(Option.scala:146) at com.mendix.webui.requesthandling.ChangesHandling$.validateChanges(ChangesHandling.scala:17) at com.mendix.webui.requesthandling.ClientRequestHandler$$anonfun$handleRequest$1.apply$mcV$sp(ClientRequestHandler.scala:306) at com.mendix.webui.requesthandling.ClientRequestHandler$$anonfun$handleRequest$1.apply(ClientRequestHandler.scala:301) at com.mendix.webui.requesthandling.ClientRequestHandler$$anonfun$handleRequest$1.apply(ClientRequestHandler.scala:301) at com.mendix.core.session.Worker$$anonfun$receive$3$$anonfun$2$$anon$1.execute(ActionDispatching.scala:143) at com.mendix.util.classloading.Runner.doRunUsingClassLoaderOf(Runner.java:36) at com.mendix.core.session.Worker$$anonfun$receive$3$$anonfun$2.apply(ActionDispatching.scala:145) at scala.util.Try$.apply(Try.scala:192) at com.mendix.core.session.Worker$$anonfun$receive$3.applyOrElse(ActionDispatching.scala:139) at akka.actor.Actor$class.aroundReceive(Actor.scala:465) at com.mendix.core.session.Worker.aroundReceive(ActionDispatching.scala:135) at akka.actor.ActorCell.receiveMessage(ActorCell.scala:516) at akka.actor.ActorCell.invoke(ActorCell.scala:487) at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:238) at akka.dispatch.Mailbox.run(Mailbox.scala:220) at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(AbstractDispatcher.scala:393) at scala.concurrent.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260) at scala.concurrent.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339) at scala.concurrent.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979) at scala.concurrent.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)   Thank you, Mohammed Siddiqui
asked
2 answers
11

Hi Mohammed! This is a bug in Mendix which has been there since i can remember. The entity access is applied correctly, however in the UI the user can change the attribute. Not really any easy solutions for this.

answered
2

You are correct that the entity access isn't correctly handled in these cases. In the UI it may seem that the values in the data grid are indeed changed, but in a test I found that these changes are not committed to the database. Also the user may get errors after these changes. I filed a ticket for this a while ago, however the fix for this issue is not scheduled for a release in the coming 6 months...

answered