Entity Access Restriction Not working to Users in Global Search in navigation

Hi Team,

i have implemented search for a custom entity called UserAssignment using search.yml.In Search field present in navigation block i am able to get search text result as expected.This custom entity has access only by Admin.When any other user other than Admin login he will not be able to access that entity But issue is when i try searching for some data which exist in Custom entity also those result would also be displayed to the user who dont have access to that entity But when he tries to click the result’s link url then it would give u dont have permission to view message which is correct as view operation for that Custom Entity has been restricted only to Admin.
I Think i am missing some ACL that has to be declared in search.yml of Custom Entity so that the whole custom entity data should not be available to users other than Admin in search suggestion & result . I tried looking for other search.yml files implementation but could not get any clue from them to solve this issue.

search.yml file for UserAssignment Custom Entity given below:

YAML

Custom\Bundle\UserAssignmentBundle\Entity\UserAssignment: alias: user_reassigment_mapper title_fields: [userFrom] route: name: usr_reassignment_view parameters: id: id search_template: CustomUserAssignmentBundle:Search:result.html.twig fields: - name: userFrom target_type: text target_fields: [userFrom] - name: userTo target_type: text target_fields: [userTo]

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Custom\Bundle\UserAssignmentBundle\Entity\UserAssignment:     alias: user_reassigment_mapper     title_fields: [userFrom]     route:         name: usr_reassignment_view         parameters:             id: id     search_template: CustomUserAssignmentBundle:Search:result.html.twig     fields:         -             name: userFrom             target_type: text             target_fields: [userFrom]         -             name: userTo             target_type: text             target_fields: [userTo]

Please need some help on how to overcome with this issue.

Thanks & Regards,
Shreyas S

Topic

[shreyasParticipant]

Hi Team,

i was able to restrict the Entity access with some modifications in Code as shown below:

In vendor\oro\platform\src\Oro\Bundle\SearchBundle\Provider\ResultStatisticsProvider.php

PHP

<?php namespace Oro\Bundle\SearchBundle\Provider; use Symfony\Component\Translation\TranslatorInterface; use Oro\Bundle\EntityConfigBundle\Config\ConfigManager; use Oro\Bundle\EntityConfigBundle\Config\Id\EntityConfigId; use Oro\Bundle\SearchBundle\Engine\Indexer; use Oro\Bundle\SearchBundle\Query\Result\Item; use Oro\Bundle\SearchBundle\Security\SecurityProvider; class ResultStatisticsProvider { /** * @var Indexer */ protected $indexer; /** * @var ConfigManager */ protected $configManager; /** * @var TranslatorInterface */ protected $translator; /** @var SecurityProvider */ protected $securityProvider; /** * @param Indexer $indexer * @param ConfigManager $configManager * @param TranslatorInterface $translator * @param SecurityProvider $securityProvider */ public function __construct(Indexer $indexer, ConfigManager $configManager, TranslatorInterface $translator,SecurityProvider $securityProvider) { $this->indexer = $indexer; $this->configManager = $configManager; $this->translator = $translator; $this->securityProvider = $securityProvider; } /** * * @param $query * @return \Oro\Bundle\SearchBundle\Query\Result */ public function getResults($query) { return $this->indexer->simpleSearch($query); } /** * Returns grouped search results * * @param string $string * @return array */ public function getGroupedResults($string) { $search = $this->getResults($string); // empty key array contains all data $result = array( '' => array( 'count' => 0, 'class' => '', 'config' => array(), 'icon' => '', 'label' => '' ) ); /** @var $item Item */ foreach ($search->getElements() as $item) { $config = $item->getEntityConfig(); $entityClass = $item->getEntityName(); $objectString = 'Entity:' . $entityClass; if ($this->securityProvider->isProtectedEntity($entityClass) && !$this->securityProvider->isGranted('VIEW', $objectString) ) { //do nothing } else{ $alias = $config['alias']; if (!isset($result[$alias])) { $group = array( 'count' => 0, 'class' => $item->getEntityName(), 'config' => $config, 'icon' => '', 'label' => '' ); if (!empty($group['class']) && $this->configManager->hasConfig($group['class'])) { $entityConfigId = new EntityConfigId('entity', $group['class']); $entityConfig = $this->configManager->getConfig($entityConfigId); if ($entityConfig->has('plural_label')) { $group['label'] = $this->translator->trans($entityConfig->get('plural_label')); } if ($entityConfig->has('icon')) { $group['icon'] = $entityConfig->get('icon'); } } $result[$alias] = $group; } $result[$alias]['count']++; $result['']['count']++; } } uasort( $result, function ($first, $second) { if ($first['label'] == $second['label']) { return 0; } return $first['label'] > $second['label'] ? 1 : -1; } ); return $result; } }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135

<?php   namespace Oro\Bundle\SearchBundle\Provider;   use Symfony\Component\Translation\TranslatorInterface;   use Oro\Bundle\EntityConfigBundle\Config\ConfigManager; use Oro\Bundle\EntityConfigBundle\Config\Id\EntityConfigId; use Oro\Bundle\SearchBundle\Engine\Indexer; use Oro\Bundle\SearchBundle\Query\Result\Item; use Oro\Bundle\SearchBundle\Security\SecurityProvider;     class ResultStatisticsProvider {     /**      * @var Indexer      */     protected $indexer;       /**      * @var ConfigManager      */     protected $configManager;       /**      * @var TranslatorInterface      */     protected $translator;          /** @var SecurityProvider */     protected $securityProvider;       /**      * @param Indexer             $indexer      * @param ConfigManager       $configManager      * @param TranslatorInterface $translator      * @param SecurityProvider    $securityProvider     */     public function __construct(Indexer $indexer, ConfigManager $configManager, TranslatorInterface $translator,SecurityProvider $securityProvider)     {         $this->indexer = $indexer;         $this->configManager = $configManager;         $this->translator = $translator;         $this->securityProvider = $securityProvider;              }       /**      *      * @param $query      * @return \Oro\Bundle\SearchBundle\Query\Result      */     public function getResults($query)     {         return $this->indexer->simpleSearch($query);     }       /**      * Returns grouped search results      *      * @param string $string      * @return array      */     public function getGroupedResults($string)     {         $search = $this->getResults($string);                // empty key array contains all data         $result = array(             '' => array(                 'count'  => 0,                 'class'  => '',                 'config' => array(),                 'icon'   => '',                 'label'  => ''             )         );           /** @var $item Item */         foreach ($search->getElements() as $item) {             $config = $item->getEntityConfig();             $entityClass = $item->getEntityName();           $objectString = 'Entity:' . $entityClass;             if ($this->securityProvider->isProtectedEntity($entityClass)                 && !$this->securityProvider->isGranted('VIEW', $objectString)             )             {                  //do nothing             }             else{                 $alias  = $config['alias'];               if (!isset($result[$alias])) {                 $group = array(                     'count'  => 0,                     'class'  => $item->getEntityName(),                     'config' => $config,                     'icon'   => '',                     'label'  => ''                 );                   if (!empty($group['class']) && $this->configManager->hasConfig($group['class'])) {                     $entityConfigId = new EntityConfigId('entity', $group['class']);                     $entityConfig = $this->configManager->getConfig($entityConfigId);                     if ($entityConfig->has('plural_label')) {                         $group['label'] = $this->translator->trans($entityConfig->get('plural_label'));                     }                     if ($entityConfig->has('icon')) {                         $group['icon'] = $entityConfig->get('icon');                     }                 }                   $result[$alias] = $group;             }               $result[$alias]['count']++;             $result['']['count']++;            }         }           uasort(             $result,             function ($first, $second) {                 if ($first['label'] == $second['label']) {                     return 0;                 }                   return $first['label'] > $second['label'] ? 1 : -1;             }         );           return $result;     } }

In function getGroupedResults() done some modification to check for Entity Access with help of securityProvider.

Also done respective changes in services.yml for oro_search.provider.result_statistics_provider as below:

YAML

oro_search.provider.result_statistics_provider: class: %oro_search.provider.result_statistics_provider.class% arguments: - @oro_search.index - @oro_entity_config.config_manager - @translator - @oro_search.security_provider lazy: true

1 2 3 4 5 6 7 8 9

oro_search.provider.result_statistics_provider:         class:                        %oro_search.provider.result_statistics_provider.class%         arguments:             - @oro_search.index             - @oro_entity_config.config_manager             - @translator             - @oro_search.security_provider                                  lazy: true

Now the Custom entity Search result is not shown other than for ADMIN Role.

But i am facing similar issue related to Entity’s Record level Access, where in ACL might not be working properly.
Ex:
i have a User who has created an Account record. This account’s record should not be visible to other user other than created user as the ownership is also registered in ACL of Account Entity.But this is not working fine with Search Result wherein it is listing many records that are not applicable to him or Business Units
under him whereas on the Account Entity index page it displays only records applicable to that user. When i try clicking on some of those search result’s records it says no permission to view record.

i observed that SearchAclHelper is being used in vendor\oro\platform\src\Oro\Bundle\SearchBundle\Engine\Indexer.php in prepareQuery() method but not working as expected.Please find code snippet for reference:

PHP

/** * Do query manipulations such as ACL apply etc. * * @param Query $query */ protected function prepareQuery(Query $query) { $this->applyModesBehavior($query); $this->searchAclHelper->apply($query); }

1 2 3 4 5 6 7 8 9 10

/**      * Do query manipulations such as ACL apply etc.      *      * @param Query $query      */     protected function prepareQuery(Query $query)     {         $this->applyModesBehavior($query);         $this->searchAclHelper->apply($query);     }

I tried commenting $this->searchAclHelper->apply($query); from above function. Then when i searched for particular search text under Account Entity from Different Users . Then number of records fetched were the same. So once after uncommenting it under each User the search result is varying but there are some Records which user does not have access to also being displayed.This is the same problem for other entities search result also.
Kindly need help in how to solve this Record Level Access Restriction of Entities to users.

[Author]

Replies