Bug Report T1135049
Visible to All Users
Duplicate

Core - The SecurityFunctionPatcher logic is not called for a non-secured XPObjectSpace

created 2 years ago (modified 2 years ago)

Steps to reproduce:

  • Add the following test for an XPO-based XAF application:
C#
[Test] public void Load_user_object_using_CurrentUserId_custom_function() { using var scope = Host.Services.GetRequiredService<IServiceScopeFactory>().CreateScope(); scope.ServiceProvider.Authenticate("Admin", ""); var security = scope.ServiceProvider.GetRequiredService<ISecurityProvider>().GetSecurity(); var user_1 = (ApplicationUser)security.User; using var os_Secured = scope.ServiceProvider.GetRequiredService<IObjectSpaceFactory>().CreateObjectSpace<ApplicationUser>(); var user_2 = os_Secured.FindObject<ApplicationUser>(CriteriaOperator.Parse("Oid=CurrentUserId()")); using var os_NonSecured = scope.ServiceProvider.GetRequiredService<INonSecuredObjectSpaceFactory>().CreateNonSecuredObjectSpace<ApplicationUser>(); var user_3 = os_NonSecured.FindObject<ApplicationUser>(CriteriaOperator.Parse("Oid=CurrentUserId()")); Assert.That(user_1.Oid, Is.EqualTo(user_2.Oid)); Assert.That(user_1.Oid, Is.EqualTo(user_3.Oid)); }
  • The same test works correctly for an EFCore-based XAF application:
C#
[Test] public void Load_user_object_using_CurrentUserId_custom_function() { using var scope = Host.Services.GetRequiredService<IServiceScopeFactory>().CreateScope(); scope.ServiceProvider.Authenticate("Admin", ""); var security = scope.ServiceProvider.GetRequiredService<ISecurityProvider>().GetSecurity(); var user_1 = (ApplicationUser)security.User; using var os_Secured = scope.ServiceProvider.GetRequiredService<IObjectSpaceFactory>().CreateObjectSpace<ApplicationUser>(); var user_2 = os_Secured.FindObject<ApplicationUser>(CriteriaOperator.Parse("Id=CurrentUserId()")); using var os_NonSecured = scope.ServiceProvider.GetRequiredService<INonSecuredObjectSpaceFactory>().CreateNonSecuredObjectSpace<ApplicationUser>(); var user_3 = os_NonSecured.FindObject<ApplicationUser>(CriteriaOperator.Parse("Id=CurrentUserId()")); Assert.That(user_1.ID, Is.EqualTo(user_2.ID)); Assert.That(user_1.ID, Is.EqualTo(user_3.ID)); }

Expected result

The non-secured XPObjectSpace uses the SecurityFunctionPatcher instance and allows customizing custom function criteria operators.

Comments (1)
M M
Martin Praxmarer - DevExpress MVP 2 years ago

    any news on this?

    Answers approved by DevExpress Support

    created 2 years ago

    We have addressed the issue described in this ticket and will include a fix in our next maintenance update. Should you need to apply our fix prior to official release, you can request a hotfix here.

    Important Notes:

    • Hotfixes may be unavailable for Early Access/Beta builds or updates set for release within a week.
    • .NET only: in the NuGet Package Manager, use your personal NuGet feed and check the "Include prerelease" option to view the hotfix package in the "Updates" tab.
      Show previous comments (27)
      Dmitry M (DevExpress) 2 years ago

        Hello Martin,

        We are working on an example to see if it is possible to add DI to XPO to cover this use case. Please stay tuned.

        Dmitry M (DevExpress) 2 years ago

          I'm closing this ticket as the initial issue is resolved. I created a separate ticket where all new results will be published: T1147982 - Security.Blazor - "ValueManagerContext.Storage is null" error occurs when a custom function criteria operator is not processed by the SecurityFunctionPatcher logic.

          Dennis Garavsky (DevExpress) 2 years ago

            My personal opinion is that moving all the custom operator code within the OnCustomizeSecurityCriteriaOperator is not easily usable within teams: each team member that use a given operator in a project needs to know that the operator logic needs to be moved within an external event listener.
            you do not have any plan to allow, for example, DI from within a Custom Function. Is my understanding correct?

            @gat: Your understanding is correct - no plans at this stage (RE: Security.Blazor - "ValueManagerContext.Storage is null" error occurs when a custom function criteria operator is not processed by the SecurityFunctionPatcher logic).

            Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

            Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.