bd4494abac
case 4712 - customer contacts reach only their own customer's work orders
...
Step 2 of 4712 (security review F13). The customer work-order rights checked
only tag-based feature switches, never which customer a work order belongs to.
New UserBiz.CustomerContactOwnsCustomerAsync (own customer, or for a head
office contact a customer of its head office), used by:
- workorder/customer/{id}: another customer's work order is not found (404);
- customer work order report (-100): exactly one work order, which must be the
contact's (the renderer used every id it was given);
- work order attachment list and download for contacts; other attachment types
are refused to contacts (the customer screens show them only on work orders).
Checked: other customer's work order 404 (was 200); report on another's or on
two work orders not found; own customer report still accepted (202).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-24 13:52:31 -07:00
176007864a
case 4578 (note, prior commit same case forgot to tag it with this message)
2024-04-08 21:05:43 +00:00
59794a6bf1
2024-04-08 19:50:16 +00:00
5f094510d9
case 4578
2024-04-08 19:10:49 +00:00
82fa744de5
case 4173
2023-05-09 22:23:54 +00:00
7039b367bd
2023-02-22 23:57:24 +00:00
993117379d
case 4322
2022-11-29 01:14:13 +00:00
98b6978d13
case 4192
2022-09-28 19:13:20 +00:00
a929188658
Added delay in batch job processing
2022-09-27 17:45:44 +00:00
d3d06766c4
licensing system change, all internal active, no more scheduleable resources / tech licensing
2022-09-12 21:57:31 +00:00
9b7508afe3
Allow login checked properly for license in subscription customer contact count check
2022-08-29 14:55:24 +00:00
01e821c8c5
2022-08-23 21:42:48 +00:00
e06334a175
More subscription license work allow logins addition
2022-08-23 21:41:20 +00:00
f8f0aeba4c
2022-08-23 14:59:58 +00:00
a9b7cafc1d
2022-08-23 14:46:24 +00:00
03d26ddc41
2022-08-23 03:02:34 +00:00
028e7b8818
More subscription license work
2022-08-23 03:00:17 +00:00
ad8f2129b3
2022-03-24 22:29:44 +00:00
0d8389c685
clean up migrate_outstanding stuff
2022-03-18 14:34:57 +00:00
f99bba70f6
auto pre-fill superuser creds if default
2022-03-11 21:08:57 +00:00
0784313e6d
2022-03-10 23:32:33 +00:00
80d73fc711
2022-01-23 16:26:06 +00:00
e8ad7901ec
2021-12-30 15:11:45 +00:00
f8d47551ee
2021-12-30 01:01:59 +00:00
075747b5b9
2021-12-28 00:44:27 +00:00
9c6b6e52c8
2021-12-23 19:16:11 +00:00
20e4826e9c
2021-12-23 17:49:06 +00:00
04abe2adcb
2021-12-23 17:48:01 +00:00
f2a5de5ad8
case 1690
2021-11-24 21:34:46 +00:00
137cf4856e
2021-11-18 20:56:31 +00:00
d466b4b0b8
2021-11-18 20:25:08 +00:00
6c2fb27eb8
2021-11-18 20:03:45 +00:00
c5d5dea7e8
2021-11-18 19:59:13 +00:00
ec9ddce6d4
2021-11-18 19:51:08 +00:00
8aed8dc8ba
2021-11-18 19:10:38 +00:00
022451ff47
2021-11-15 20:09:20 +00:00
98d495dfd2
Customer access
2021-11-12 20:49:31 +00:00
278d913ac6
fixed not enough licenses error not displaying at client when attempt to add too many service techs
2021-11-11 23:19:44 +00:00
f946a472b1
User ValidateCanDelete switched to checking all references from only event log
2021-11-10 23:58:00 +00:00
8d9e430f91
User ValidateCanDelete switched to checking all references from only event log
2021-11-10 23:50:36 +00:00
fe0eaef9e0
Deactivate users cancel auth token, also docs
2021-11-10 21:31:37 +00:00
5fdd5c73ba
2021-10-18 19:46:09 +00:00
ec67ecab23
2021-09-30 23:41:56 +00:00
220f185418
2021-09-08 23:33:01 +00:00
a944fb10e1
2021-09-03 23:48:41 +00:00
b827ec1285
2021-08-16 23:18:37 +00:00
49bd0d2d87
Removed superfluous try catch throw pattern
2021-08-05 23:14:12 +00:00
7c033a6e84
2021-08-05 22:52:47 +00:00
56d8cc27cb
Renamed roles and trans keys "Limited"->"Restricted" "Full" -> ""
2021-07-12 17:19:09 +00:00
779a695ff7
2021-06-30 20:27:35 +00:00
