Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-21554

In Spreadsheet View Users with "Add Record" permission can "update" other users' records

    Details

    • Type: Bug
    • Status: Closed
    • Resolution: No Longer Reproducible
    • Affects Version/s: 6.1.0 CE RC1, 6.2.0 CE M2
    • Fix Version/s: --Sprint 11/12, 6.2.0 CE M2
    • Component/s: Dynamic Data Lists
    • Labels:
    • Environment:
      Tomcat 7 + Mysql 5 with trunk 95871

      Description

      In the Spreadsheet View, users who have "Add Record" permission can "Update" other users' record.

      (Keep in mind that in the regular view, users can only add record).

      Add Dynamic Data List portlet to a page.
      1. Create a data list definition and add a data list, let's call it "DDL1"
      2. Add the data list display portlet to a page, select the "DDL1" we've just created.
      3. Check the "Editable" and "Spreasheet" View box
      3. Create "user 1" and "user 2", grant them permission to add records.
      4. Log in as "user 1", add a record. let's call it "us1rcrd1"
      Log in as "user 2", add a record. let's call it "us2rcrd2"
      5. With the "user 2" logged in, you can actually change "us1rcrd1", which is not desired.

        Attachments

          Activity

            People

            • Assignee:
              ginson.ren Ginson Ren
              Reporter:
              lulu.liu Lulu Liu (Inactive)
              Participants of an Issue:
              Recent user:
              Esther Sanz
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Days since last comment:
                7 years, 46 weeks, 3 days ago

                Packages

                Version Package
                --Sprint 11/12
                6.2.0 CE M2