Forum Discussion

Nathan_H_'s avatar
Nathan_H_
Ideator I
3 years ago
Solved

Javascript Temporary Permissions

Good day all.  I'm still using v11 SP10.  How do I grant temporary permission for a user through Javascript?  I want to add a Comments tab to our custom change ItemType.  I have a script attached to an Action to open a dialog box so a user can add a comment.  The Submit button runs another script to pull the comments field information and sends it back to the original script.  The original script then creates a Comments relationship entry for the change.  I have this working except when the change is in the In Review Life Cycle state for normal user, it works for admins.  I want to temporarily grant Aras PLM identity to the user so it can be added.  I don't want to allow users to be able to edit anything else in the change while it is In Review.  

Method:  DEMO_Notes_Form

[embed:dc8ab71f-3b98-42d9-b0f6-e21e02a0f8e2:21786300-fbfe-4e4d-aea7-c06e604e5f48:type=text&text=%2F%2F%20Aras%20Labs%20Project%0A%2F%2F%20Eli%20Donahue%20-%2010%2F5%2F16%0A%2F%2F%0A%2F%2F%20Call%20a%20custom%20form%20in%20a%20modal%20dialog%0A%2F%2F%20Perform%20some%20action%20based%20on%20the%20values%20returned%20from%20dialog%0A%0A%2F%2F%20Aras%20Labs%20Project%0A%2F%2F%20Eli%20Donahue%20-%2010%2F5%2F16%0A%2F%2F%0A%2F%2F%20Call%20a%20custom%20form%20in%20a%20modal%20dialog%0A%2F%2F%20Perform%20some%20action%20based%20on%20the%20values%20returned%20from%20dialog%0A%0Avar%20inn%20%3D%20new%20Innovator%28%29%3B%0A%0A%2F%2F%20var%20thisItem%20%3D%20document.getThis%0A%0Avar%20topWnd%20%3D%20aras.getMostTopWindowWithAras%28window%29%3B%0A%20%20%20%20topWnd%20%3D%20topWnd.main%20%7C%7C%20topWnd%3B%0A%0A%2F%2F%20get%20form%0Avar%20formName%20%3D%20%22DEMO_Change_Notes%22%3B%0Avar%20fetchForm%20%3D%20this.getInnovator%28%29.newItem%28%22Form%22%2C%22get%22%29%3B%0A%20%20%20%20fetchForm.setProperty%28%22name%22%2CformName%29%3B%0A%20%20%20%20fetchForm%20%3D%20fetchForm.apply%28%22get%22%29%3B%20%0A%0A%2F%2F%20check%20form%20for%20error%0Aif%20%28fetchForm.isError%28%29%29%0A%20%20%20%20return%20alert%28%22Can%27t%20find%20a%20form%20called%20%22%20%2B%20formName%29%3B%0A%0A%2F%2F%20get%20form%20params%0Avar%20params%20%3D%20%0A%7B%0A%20%20%20%20title%3A%20%27Change%20Notes%27%2C%20%0A%20%20%20%20formId%3A%20fetchForm.getID%28%29%2C%20%20%20%20%20%20%20%2F%2F%20put%20your%20form%27s%20id%20here%0A%20%20%20%20aras%3A%20aras%2C%0A%20%20%20%20dialogWidth%3A%20600%2C%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2F%2F%20set%20width%20int%0A%20%20%20%20dialogHeight%3A%20400%2C%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2F%2F%20set%20height%20int%0A%20%20%20%20content%3A%20%27ShowFormAsADialog.html%27%0A%7D%3B%0A%0Avar%20parentItem%20%3D%20parent.thisItem%3B%0Avar%20value%20%3D%20parentItem.getProperty%28%22id%22%2C%22%22%29%3B%0Avar%20userID%20%3D%20aras.getCurrentUserID%28%29%3B%0A%0Avar%20callback2%20%3D%20function%28res%29%20%0A%7B%0A%20%20%20%20var%20innovator%20%3D%20new%20Innovator%28%29%3B%0A%20%20%20%20%0A%20%20%20%20var%20partItem%20%3D%20innovator.newItem%28%22sm_DEMO_NDR_Notes%22%2C%22add%22%29%3B%0A%20%20%20%20%20%20%20%20partItem.setProperty%28%22source_id%22%2C%20value%29%3B%0A%20%20%20%20%20%20%20%20partItem.setProperty%28%22comments%22%2C%20res.param1%29%3B%0A%20%20%20%20%0A%20%20%20%20var%20resultItem%20%3D%20partItem.apply%28%29%3B%0A%7D%0A%2F%2F%20call%20form%20in%20dialog%0AtopWnd.ArasModules.Dialog.show%28%22iframe%22%2C%20params%29.promise.then%28callback2%29%3B%0A%0A%0Areturn%20null%3B]

DEMO_SUBMIT-Notes

[embed:dc8ab71f-3b98-42d9-b0f6-e21e02a0f8e2:d1caeab1-ea95-416a-bc29-4defadc197c8:type=text&text=%2F%2F%20Aras%20Labs%20Project%0A%2F%2F%20Eli%20Donahue%20-%2010%2F5%2F16%0A%2F%2F%0A%2F%2F%20onClick%20field%20event%20for%20Submit%20button%0A%2F%2F%20Returns%20the%20form%20field%20values%20to%20the%20method%20that%20called%20the%20current%20dialog%0A%0A%2F%2F%20get%20param1%20field%0Avar%20wrapper1%20%3D%20getFieldByName%28%22comments%22%29%3B%0Avar%20p1%20%3D%20wrapper1.getElementsByTagName%28%22textarea%22%29%5B0%5D%3B%0A%0A%2F%2F%20confirm%20fields%20were%20correctly%20retrieved%0Aif%20%28%21p1%29%0A%7B%0A%09alert%28%22Can%27t%20find%20field%20param1%22%29%3B%0A%09return%3B%0A%7D%0A%0A%2F%2F%20return%20entered%20values%0Avar%20retVal%20%3D%20%7B%7D%3B%0A%20%20%20%20retVal%5B%22param1%22%5D%20%3D%20p1.value%3B%0A%20%20%20%20retVal%5B%22param2%22%5D%20%3D%20sourceID%3B%0A%20%20%20%20%2F%2F%20retVal%5B%22searchResult%22%5D%20%3D%20p3.value%3B%0A%0Aparent.returnValue%20%3D%20retVal%3B%20%0Aparent.close%28%29%3B]

  • You cannot grant temporary permission for a user through Javascript. In general this is impossible.

    Just image somebody builds his own Aras Client and is able to influence permission this way. This way regular users could transform themselves into root accounts. Would be a great way to hack a system!

    What you want do is not a uncommon task. I do the same in my own dialog calls. You need an additional Server Method that is called from the dialog. The Server Method uses GrantPermission so you can execute the query with Aras PLM or similar rights. You should be able to find GrantPermission samples online. Even Aras use this technique.

     

  • Angela,

    Thanks for confirming this.  I had thought that was the case.

4 Replies

  • You cannot grant temporary permission for a user through Javascript. In general this is impossible.

    Just image somebody builds his own Aras Client and is able to influence permission this way. This way regular users could transform themselves into root accounts. Would be a great way to hack a system!

    What you want do is not a uncommon task. I do the same in my own dialog calls. You need an additional Server Method that is called from the dialog. The Server Method uses GrantPermission so you can execute the query with Aras PLM or similar rights. You should be able to find GrantPermission samples online. Even Aras use this technique.

     

    • Nathan_H_'s avatar
      Nathan_H_
      Ideator I

      Angela,

      Thanks for confirming this.  I had thought that was the case.

      • AngelaIp's avatar
        AngelaIp
        Ideator I

        Check out my Method call collection:

        https://plm-underground.com/method-calls

        It doesn´t include the grant permission stuff, but shows how to return and use the results/items. It´s an old article, but the calls haven´t changed much (especially when you use an Innovator 11 dinosaur).