Thevinu Jayasekara created FINERACT-2982:
--------------------------------------------
Summary: Extend office-hierarchy access checks to remaining
monetary operations
Key: FINERACT-2982
URL: https://issues.apache.org/jira/browse/FINERACT-2982
Project: Apache Fineract
Issue Type: Bug
Reporter: Thevinu Jayasekara
FINERACT-2639 (PR [#6698|https://github.com/apache/fineract/pull/6698]) added
office-hierarchy checks to loan, savings, account transfer, fixed/recurring
deposit and collection sheet transactions. A user can only post them on
accounts in their own office or a child office.
The following operations can still create money-bearing transactions on
accounts outside
the user's office hierarchy:
* Account activation that posts an initial deposit: savings, fixed deposit,
recurring deposit
(SavingsAccountWritePlatformServiceJpaRepositoryImpl.activate,
DepositAccountWritePlatformServiceJpaRepositoryImpl.activateFDAccount /
activateRDAccount)
* Capitalized income (CapitalizedIncomeWritePlatformServiceImpl)
* Buy-down fee (BuyDownFeeWritePlatformServiceImpl)
* Re-age and re-amortize (LoanReAgingService, LoanReAmortizationService)
* Interest pause (InterestPauseWritePlatformServiceImpl)
* Contract termination (LoanContractTerminationServiceImpl)
* Working-capital loans: repayment, charge-off and related write services in
fineract-working-capital-loan
* Share accounts (ShareAccountWritePlatformServiceJpaRepositoryImpl)
Expected: these user-triggered operations use the same in-user-scope loaders as
FINERACT-2639, so a user outside the account's office hierarchy gets a 403.
Scheduled jobs and internal reversals stay unchanged.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
