ACL/datagrid issue

Hi,

I have a trouble rendering a datagrid and select options even though IMO I’ve set up everything just fine.

I wrote a Survey Bundle that allows users to create surveys and fill them in on custom Customer view. The entity and all survey-related actions are ACL-protected and everything works fine except two cases:

1) datagrids protected by ‘vendor_survey_view’ show no results even though there are records in DB and user has proper access rights. Here is some code:

Entity:

PHP

/** * @ORM\Entity(repositoryClass="Vendor\Bundle\SurveyBundle\Entity\Repository\SurveyRepository") * @ORM\Table("vendor_survey") * @ORM\HasLifecycleCallbacks() * @Config( * defaultValues={ * "ownership"={ * "owner_type"="USER", * "owner_field_name"="owner", * "owner_column_name"="user_owner_id" * }, * "security"={ * "type"="ACL", * "group_name"="" * }, * "dataaudit"={ * "auditable"=true * } * } * ) */ class Survey extends ExtendSurvey { //properties etc. }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

/** * @ORM\Entity(repositoryClass="Vendor\Bundle\SurveyBundle\Entity\Repository\SurveyRepository") * @ORM\Table("vendor_survey") * @ORM\HasLifecycleCallbacks() * @Config( *     defaultValues={ *          "ownership"={ *              "owner_type"="USER", *              "owner_field_name"="owner", *              "owner_column_name"="user_owner_id" *          }, *          "security"={ *               "type"="ACL", *               "group_name"="" *          }, *          "dataaudit"={ *              "auditable"=true *          } *     } * ) */ class Survey extends ExtendSurvey {     //properties etc. }

Controller:

PHP

/** * @Route("/survey") */ class SurveyController extends Controller { /** * @Route("/", name="vendor_survey_index") * @Acl( * id="vendor_survey_view", * type="entity", * permission="VIEW", * class="VendorSurveyBundle:Survey" * ) * @Template */ public function indexAction() { return [ 'entity_class' => $this->container->getParameter('vendor_survey.survey.entity.class') ]; } }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

/** * @Route("/survey") */ class SurveyController extends Controller {     /**      * @Route("/", name="vendor_survey_index")      * @Acl(      *     id="vendor_survey_view",      *     type="entity",      *     permission="VIEW",      *     class="VendorSurveyBundle:Survey"      * )      * @Template      */     public function indexAction()     {         return [             'entity_class' => $this->container->getParameter('vendor_survey.survey.entity.class')         ];     } }

Template:

PHP

{% extends 'OroUIBundle:actions:index.html.twig' %} {% import 'OroUIBundle::macros.html.twig' as UI %} {% set gridName = 'vendor-survey-grid' %} {% set pageTitle = 'vendor.survey.entity_plural_label'|trans %} {% block navButtons %} {% if resource_granted('vendor_survey_create') %} <div class="btn-group"> {{ UI.addButton({ 'path' : path('vendor_survey_create'), 'entity_label': 'vendor.survey.entity_label'|trans }) }} </div> {% endif %} {% endblock %}

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

{% extends 'OroUIBundle:actions:index.html.twig' %} {% import 'OroUIBundle::macros.html.twig' as UI %} {% set gridName = 'vendor-survey-grid' %} {% set pageTitle = 'vendor.survey.entity_plural_label'|trans %}   {% block navButtons %}     {% if resource_granted('vendor_survey_create') %}         <div class="btn-group">             {{ UI.addButton({                 'path' : path('vendor_survey_create'),                 'entity_label': 'vendor.survey.entity_label'|trans             }) }}         </div>     {% endif %} {% endblock %}

Datagrid:

YAML

datagrids: vendor-survey-grid: extended_entity_name: %vendor_survey.survey.entity.class% acl_resource: vendor_survey_view source: type: orm query: select: - s.id - s.title - s.description - CONCAT_WS(' ', o.firstName, o.lastName) as ownerName - s.createdAt - s.updatedAt from: - { table: %vendor_survey.survey.entity.class%, alias: s } join: left: - { join: s.owner, alias: o } inline_editing: enable: true columns: title: label: vendor.survey.title.label description: label: vendor.survey.description.label ownerName: label: vendor.survey.owner.label createdAt: label: oro.ui.created_at frontend_type: datetime updatedAt: label: oro.ui.updated_at frontend_type: datetime sorters: columns: title: { data_name: s.title } description: { data_name: s.description } ownerName: { data_name: ownerName } createdAt: { data_name: s.createdAt } updatedAt: { data_name: s.updatedAt } filters: columns: title: type: string data_name: s.title description: type: string data_name: s.description ownerName: type: choice-tree data_name: s.owner label: vendor.survey.owner.label autocomplete_alias: users renderedPropertyName: 'fullName' className: 'Oro\Bundle\UserBundle\Entity\User' createdAt: type: datetime data_name: s.createdAt updatedAt: type: datetime data_name: s.updatedAt properties: id: ~ update_link: type: url route: vendor_survey_update params: [ id ] delete_link: type: url route: vendor_api_delete_survey params: [ id ] actions: update: type: navigate acl_resource: vendor_survey_update label: oro.grid.action.update icon: edit link: update_link delete: type: delete acl_resource: vendor_survey_delete icon: trash link: delete_link options: entityHint: surveys entity_pagination: true

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87

datagrids:     vendor-survey-grid:         extended_entity_name: %vendor_survey.survey.entity.class%         acl_resource: vendor_survey_view         source:             type: orm             query:                 select:                     - s.id                     - s.title                     - s.description                     - CONCAT_WS(' ', o.firstName, o.lastName) as ownerName                     - s.createdAt                     - s.updatedAt                 from:                     - { table: %vendor_survey.survey.entity.class%, alias: s }                 join:                     left:                         - { join: s.owner, alias: o }         inline_editing:             enable: true         columns:             title:                 label: vendor.survey.title.label             description:                 label: vendor.survey.description.label             ownerName:                 label: vendor.survey.owner.label             createdAt:                 label: oro.ui.created_at                 frontend_type: datetime             updatedAt:                 label: oro.ui.updated_at                 frontend_type: datetime         sorters:             columns:                 title:        { data_name: s.title }                 description:  { data_name: s.description }                 ownerName:    { data_name: ownerName }                 createdAt:    { data_name: s.createdAt }                 updatedAt:    { data_name: s.updatedAt }         filters:             columns:                 title:                     type: string                     data_name: s.title                 description:                     type: string                     data_name: s.description                 ownerName:                     type: choice-tree                     data_name: s.owner                     label: vendor.survey.owner.label                     autocomplete_alias: users                     renderedPropertyName: 'fullName'                     className: 'Oro\Bundle\UserBundle\Entity\User'                 createdAt:                     type: datetime                     data_name: s.createdAt                 updatedAt:                     type: datetime                     data_name: s.updatedAt         properties:             id: ~             update_link:                 type: url                 route: vendor_survey_update                 params: [ id ]             delete_link:                 type: url                 route: vendor_api_delete_survey                 params: [ id ]         actions:             update:                 type: navigate                 acl_resource: vendor_survey_update                 label: oro.grid.action.update                 icon: edit                 link: update_link             delete:                 type: delete                 acl_resource: vendor_survey_delete                 icon: trash                 link: delete_link         options:             entityHint: surveys             entity_pagination: true

This all together allows me to go the the view, create a survey but after that nothing shows in the datagrid. If I delete the ACL annotation of entity and update the configuration, datagrid renders properly but then it’s not ACL-protected and it’s not the result I want. I checked the query in profiler and it looks like that:

MySQL

SELECT e0_.id AS id_0, e0_.title AS title_1, e0_.description AS description_2, CONCAT_WS( ' ', o1_.first_name, o1_.last_name ) AS sclr_3, e0_.created_at AS created_at_4, e0_.updated_at AS updated_at_5 FROM vendor_survey e0_ LEFT JOIN oro_user o1_ ON e0_.user_owner_id = o1_.id WHERE 1 = 0 ORDER BY e0_.id ASC LIMIT 25

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

SELECT   e0_.id AS id_0,   e0_.title AS title_1,   e0_.description AS description_2,   CONCAT_WS(     ' ', o1_.first_name, o1_.last_name   ) AS sclr_3,   e0_.created_at AS created_at_4,   e0_.updated_at AS updated_at_5 FROM   vendor_survey e0_   LEFT JOIN oro_user o1_ ON e0_.user_owner_id = o1_.id WHERE   1 = 0 ORDER BY   e0_.id ASC LIMIT   25

I see why there are no results returned but where did ‘WHERE 1=0’ come from?

2) in another action of the same controller, called on Customer view, I create a popup with select filled with Surveys; without ACL it renders properly but after enabling it in entity’s annotation it’s empty. Code:

Controller:

PHP

/** * @Route( * "/select/{customerId}", * name="vendor_survey_select", * requirements={"customerId"="\d+"} * ) * @ParamConverter("customer", options={"mapping": {"customerId":"id"}}) * @Template() * @AclAncestor("vendor_survey_response_create") */ public function selectAction(Request $request, Customer $customer) { $responseData['redirect'] = false; if ($request->getMethod() == 'POST') { $responseData['redirect'] = true; $responseData['url'] = $this->generateUrl( 'vendor_survey_response_create', [ 'surveyId' => $request->request->get('form')['survey'], 'customerId' => $customer->getId() ] ); } $form = $this->createFormBuilder() ->add( 'survey', EntityType::class, [ 'class' => 'Vendor\Bundle\SurveyBundle\Entity\Survey', 'required' => true, 'label' => 'vendor.survey.entity_plural_label', 'choice_label' => 'title', 'query_builder' => function (EntityRepository $entityRepository) { return $entityRepository->createQueryBuilder('s') ->orderBy('s.title', 'ASC'); } ] ) ->setAction($this->generateUrl('vendor_survey_select', ['customerId' => $customer->getId()])) ->getForm(); $responseData['form'] = $form->createView(); return $responseData; }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

/**      * @Route(      *     "/select/{customerId}",      *     name="vendor_survey_select",      *     requirements={"customerId"="\d+"}      * )      * @ParamConverter("customer", options={"mapping": {"customerId":"id"}})      * @Template()      * @AclAncestor("vendor_survey_response_create")      */     public function selectAction(Request $request, Customer $customer)     {         $responseData['redirect'] = false;         if ($request->getMethod() == 'POST') {             $responseData['redirect'] = true;             $responseData['url'] = $this->generateUrl(                 'vendor_survey_response_create',                 [                     'surveyId'   => $request->request->get('form')['survey'],                     'customerId' => $customer->getId()                 ]             );         }           $form = $this->createFormBuilder()             ->add(                 'survey',                 EntityType::class,                 [                     'class'         => 'Vendor\Bundle\SurveyBundle\Entity\Survey',                     'required'      => true,                     'label'         => 'vendor.survey.entity_plural_label',                     'choice_label'  => 'title',                     'query_builder' => function (EntityRepository $entityRepository) {                         return $entityRepository->createQueryBuilder('s')                             ->orderBy('s.title', 'ASC');                     }                 ]             )             ->setAction($this->generateUrl('vendor_survey_select', ['customerId' => $customer->getId()]))             ->getForm();         $responseData['form'] = $form->createView();           return $responseData;     }

Template:

PHP

<div class="widget-content"> {% if redirect %} <script type="text/javascript"> require([ 'oroui/js/widget-manager', 'oroui/js/mediator' ], function (widgetManager, mediator) { widgetManager.getWidgetInstance({{ app.request.get('_wid')|json_encode|raw }}, function(widget) { widget.remove(); mediator.execute('redirectTo', {url: '{{ url }}' }); }); }); </script> {% else %} <div class="form-container"> <form id="{{ form.vars.id }}" name="survey-select" action="{{ form.vars.action }}" method="post" class="survey-select-form"> <fieldset class="form-horizontal"> <div class="pull-left"> {{ form_row(form.survey) }} </div> </fieldset> <fieldset class="form-horizontal"> <div class="widget-actions form-actions" style="display: none;"> <button class="btn" type="reset">{{ 'Cancel'|trans }}</button> <button class="btn btn-primary" type="submit">{{ 'Proceed'|trans }}</button> </div> </fieldset> </form> </div> {% endif %} </div>

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

<div class="widget-content">     {% if redirect %}         <script type="text/javascript">             require([                 'oroui/js/widget-manager',                 'oroui/js/mediator'             ], function (widgetManager, mediator) {                 widgetManager.getWidgetInstance({{ app.request.get('_wid')|json_encode|raw }}, function(widget) {                     widget.remove();                     mediator.execute('redirectTo', {url: '{{ url }}' });                 });             });         </script>     {% else %}     <div class="form-container">         <form id="{{ form.vars.id }}" name="survey-select" action="{{ form.vars.action }}" method="post" class="survey-select-form">             <fieldset class="form-horizontal">                 <div class="pull-left">                     {{ form_row(form.survey) }}                 </div>             </fieldset>             <fieldset class="form-horizontal">                 <div class="widget-actions form-actions" style="display: none;">                     <button class="btn" type="reset">{{ 'Cancel'|trans }}</button>                     <button class="btn btn-primary" type="submit">{{ 'Proceed'|trans }}</button>                 </div>             </fieldset>         </form>     </div>     {% endif %} </div>

This is even more surprising as I don’t check the access rights to Survey in this action.

Any ideas? Is my code wrong or did I miss something in the configuration?

Topic

[Michal MatusiakParticipant]

Solved. I was missing the organization property and

PHP

* "organization_field_name"="organization", * "organization_column_name"="organization_id"

1 2	*              "organization_field_name"="organization", *              "organization_column_name"="organization_id"

in the entity config.

[Author]

Replies