An action is associated with a button, ie clicking a button activating an action.
While we can hide a button on a screen when defining a role, so that the action cannot be activated by the button. However, when we right click the mouse on the function, the action associating with the button still come out for selection. Then we hide the action associated with the button when we defined the role. But hiding an action seems producing no effect. This seems to be a back door loophole.
Hi,
Can you show how do you define a UI permission for the action?
Also, which is this action? Some standard one, like Edit / Remove, or a custom action?
Note that if the custom actionβs parameters are changed dynamically during the screen lifecycle, e.g. setVisible(true) is called - then this flag overrides the state determined by the UI permission. So the developer should write action code carefully.
The first extract shows that we hide the action Create i(and other actions) s disabled when assigning role.
The second extract shows we assign the role to user.
The third extract shows the action Create is still shown in the action list when the user right clicks mouse.
(In fact we have disabled both of all buttons and actions, but only buttons are hidden, there seems no effect to actions, all actions are still shown on the action list.)
Note how you should specify component ID in the permission for table actions:
- To configure permission for an action, specify the component, holding the action, and then the action identifier in angle brackets. For example:
customersTable<changeGrade>.
https://doc.cuba-platform.com/manual-7.2/permissions.html
This way, it worked for me.
1 Like
Thanks a lot.
We able to disable the action by Component ID with a angle bracketed action now.