Return-Path: 
 <commits-return-8713-apmail-ofbiz-commits-archive=ofbiz.apache.org@ofbiz.apache.org>
Delivered-To: apmail-ofbiz-commits-archive@www.apache.org
Received: (qmail 93530 invoked from network); 7 Sep 2008 14:35:02 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 7 Sep 2008 14:35:02 -0000
Received: (qmail 3872 invoked by uid 500); 7 Sep 2008 14:35:00 -0000
Delivered-To: apmail-ofbiz-commits-archive@ofbiz.apache.org
Received: (qmail 3844 invoked by uid 500); 7 Sep 2008 14:34:59 -0000
Mailing-List: contact commits-help@ofbiz.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:commits-help@ofbiz.apache.org>
List-Unsubscribe: <mailto:commits-unsubscribe@ofbiz.apache.org>
List-Post: <mailto:commits@ofbiz.apache.org>
List-Id: <commits.ofbiz.apache.org>
Reply-To: dev@ofbiz.apache.org
Delivered-To: mailing list commits@ofbiz.apache.org
Received: (qmail 3835 invoked by uid 99); 7 Sep 2008 14:34:59 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 07 Sep 2008 07:34:59 -0700
X-ASF-Spam-Status: No, hits=-2000.0 required=10.0
	tests=ALL_TRUSTED
X-Spam-Check-By: apache.org
Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 07 Sep 2008 14:34:09 +0000
Received: by eris.apache.org (Postfix, from userid 65534)
	id 32B402388878; Sun,  7 Sep 2008 07:34:11 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: svn commit: r692863 -
 /ofbiz/trunk/applications/content/widget/content/DataResourceScreens.xml
Date: Sun, 07 Sep 2008 14:34:11 -0000
To: commits@ofbiz.apache.org
From: adrianc@apache.org
X-Mailer: svnmailer-1.0.8
Message-Id: <20080907143411.32B402388878@eris.apache.org>
X-Virus-Checked: Checked by ClamAV on apache.org

Author: adrianc
Date: Sun Sep  7 07:34:10 2008
New Revision: 692863

URL: http://svn.apache.org/viewvc?rev=692863&view=rev
Log:
Fixed a problem with a Content Manager ajax form - reported in https://issues.apache.org/jira/browse/OFBIZ-1949.

Ajax developers note: "ajaxed" screen portions MUST include the same permissions checking as the entire screen, otherwise a security hole is opened up.

Modified:
    ofbiz/trunk/applications/content/widget/content/DataResourceScreens.xml

Modified: ofbiz/trunk/applications/content/widget/content/DataResourceScreens.xml
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/content/widget/content/DataResourceScreens.xml?rev=692863&r1=692862&r2=692863&view=diff
==============================================================================
--- ofbiz/trunk/applications/content/widget/content/DataResourceScreens.xml (original)
+++ ofbiz/trunk/applications/content/widget/content/DataResourceScreens.xml Sun Sep  7 07:34:10 2008
@@ -49,6 +49,14 @@
     </screen>
     <screen name="findDataResourceSearchResults">
         <section>
+            <condition>
+                <if-has-permission permission="CONTENTMGR" action="UPDATE"/>
+            </condition>
+            <actions>
+                <property-map resource="ContentUiLabels" map-name="uiLabelMap" global="true"/>
+                <property-map resource="CommonUiLabels" map-name="uiLabelMap" global="true"/>
+                <property-map resource="WorkEffortUiLabels" map-name="uiLabelMap" global="true"/>
+            </actions>
             <widgets>
                 <include-form name="ListDataResource" location="component://content/widget/content/DataResourceForms.xml"/>
             </widgets>