Hide
original bugid: #6086
Some security issues still remain:
- the wizards do not check if a relation between two objects is allowed. This should probably be checked in list.jsp when creating a searchlist
- popupwizards ('startwizard' fields and commands) now check if you can edit an object, but not if you can create it. This is because you cannot read rights directly from the name for a wizard. A xml reader may be used to facilitate info about a wizard (by pre-fetching it and checking the create action in the xml).
Show
original bugid: #6086
Some security issues still remain:
- the wizards do not check if a relation between two objects is allowed. This should probably be checked in list.jsp when creating a searchlist
- popupwizards ('startwizard' fields and commands) now check if you can edit an object, but not if you can create it. This is because you cannot read rights directly from the name for a wizard. A xml reader may be used to facilitate info about a wizard (by pre-fetching it and checking the create action in the xml).
Bug
Open
Major
As far as i know a lot of users are using the editwizards so we will be supporting for the coming years.