Some users may experience random login-problems to our Community. We are investigating the root cause of this. If you get an error message from CloudFlare, please send the RayID in the message to support@superoffice.com. You may also clear your browser cookies and cashe to solve it. Thanks for your understanding. 

Bug: CRMScript: After saving company trigger executes even though user had no rights to create company

Status: Reported

Description
Tested and reproduced in: 

SuperOffice CRM Online 10.5 Build Release_10.5.4_2025.04.03-04 in Chrome.

1. Create a CRMScript trigger on "After saving company": 

#setLanguageLevel 4;
EventData ed = getEventData();
log("After saving company trigger was run with EventData:"  + ed.getInputValues().toJson());

2. In admin, make a role where Company <--> Other associates is set to "Read".
This means a user cannot create or update a company where the user has no user groups in common with the current user.



3. Find a user that you have no user groups in common with, and note it down.
4. Give YOUR user the new role you made in step 2 . Log out and in again. (I did this with a non-admin user, not sure if that matters)
5. Create a new company where "Our contact" is the user you have no user groups in common with.

Expected result:
That the After saving trigger is not executed when Sentry has denied access.


Actual result:
You get message "Sentry denies Write access". This is expected, because you do not have access to create a company on behalf of this other user:

Check in the log_events table for the log message in the CRMScript trigger.
You should see that the trigger was executed even though the company was never saved.

In the EventData, Contact ID is 0, which can cause issues because we normally take for granted that there should be a contact ID in the after saving trigger.

Kommentarer
Detaljer
Problem id 76494
Registreret 30 apr. 2025
Sidst ændret 30 apr. 2025
Alvorsgrad Medium
Område Sales
Status Reported
Mål for frigivelse
Type Bug