fix transition security

on check payment, fix control when doing manual validation

git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@19057 20353a03-c40f-0410-a6d1-a30d3c3de9de

bt5/erp5_banking_check/WorkflowTemplateItem/portal_workflow/check_deposit_workflow/transitions/order.xml

@@ -44,7 +44,7 @@
         <item>
             <key> <string>guard</string> </key>
             <value>
-              <persistent> <string encoding="base64">AAAAAAAAAAI=</string> </persistent>
+              <none/>
             </value>
         </item>
         <item>
@@ -70,25 +70,4 @@
       </dictionary>
     </pickle>
   </record>
-  <record id="2" aka="AAAAAAAAAAI=">
-    <pickle>
-      <tuple>
-        <global name="Guard" module="Products.DCWorkflow.Guard"/>
-        <tuple/>
-      </tuple>
-    </pickle>
-    <pickle>
-      <dictionary>
-        <item>
-            <key> <string>roles</string> </key>
-            <value>
-              <tuple>
-                <string>Manager</string>
-                <string>Assignee</string>
-              </tuple>
-            </value>
-        </item>
-      </dictionary>
-    </pickle>
-  </record>
 </ZopeData>

bt5/erp5_banking_check/WorkflowTemplateItem/portal_workflow/check_payment_workflow/scripts/checkAccountIsOverdraftFacility.xml

@@ -81,7 +81,7 @@ transaction.Baobab_checkCounterDateOpen(site=source, date=date)\n
 site = transaction.getSourceValue()\n
 \n
 # For safety, check the consistency again.\n
-context.validateConsistency(state_change)\n
+context.validateConsistency(state_change, no_balance_check=1)\n
 \n
 line = transaction.movement\n
 bank_account = transaction.getDestinationPaymentValue()\n

bt5/erp5_banking_check/WorkflowTemplateItem/portal_workflow/check_payment_workflow/scripts/validateConsistency.xml

@@ -140,6 +140,9 @@ transaction.edit(aggregate=check.getRelativeUrl())\n
 \n
 context.updateBankingOperation(state_change)\n
 \n
+if no_balance_check == 1:\n
+  return\n
+\n
 # Test if the account balance is sufficient.\n
 # We do not need to serialize here because we do not make\n
 # reservation yet\n
@@ -171,7 +174,7 @@ elif error[\'error_code\'] != 0:\n
         </item>
         <item>
             <key> <string>_params</string> </key>
-            <value> <string>state_change, **kw</string> </value>
+            <value> <string>state_change, no_balance_check=0, **kw</string> </value>
         </item>
         <item>
             <key> <string>_proxy_roles</string> </key>
@@ -199,13 +202,14 @@ elif error[\'error_code\'] != 0:\n
                   <dictionary>
                     <item>
                         <key> <string>co_argcount</string> </key>
-                        <value> <int>1</int> </value>
+                        <value> <int>2</int> </value>
                     </item>
                     <item>
                         <key> <string>co_varnames</string> </key>
                         <value>
                           <tuple>
                             <string>state_change</string>
+                            <string>no_balance_check</string>
                             <string>kw</string>
                             <string>Products.DCWorkflow.DCWorkflow</string>
                             <string>ValidationFailed</string>
@@ -242,7 +246,9 @@ elif error[\'error_code\'] != 0:\n
         <item>
             <key> <string>func_defaults</string> </key>
             <value>
-              <none/>
+              <tuple>
+                <int>0</int>
+              </tuple>
             </value>
         </item>
         <item>

bt5/erp5_banking_check/WorkflowTemplateItem/portal_workflow/check_payment_workflow/scripts/validatePositionAccounting.xml

@@ -83,7 +83,7 @@ site = transaction.getSourceValue()\n
 transaction.Baobab_checkCounterOpened(site)\n
 \n
 # For safety, check the consistency again.\n
-context.validateConsistency(state_change)\n
+context.validateConsistency(state_change, no_balance_check=1)\n
 \n
 line = transaction.movement\n
 bank_account = transaction.getDestinationPaymentValue()\n

bt5/erp5_banking_check/WorkflowTemplateItem/portal_workflow/check_payment_workflow/transitions/order.xml

@@ -38,7 +38,7 @@
         <item>
             <key> <string>guard</string> </key>
             <value>
-              <persistent> <string encoding="base64">AAAAAAAAAAI=</string> </persistent>
+              <none/>
             </value>
         </item>
         <item>
@@ -64,25 +64,4 @@
       </dictionary>
     </pickle>
   </record>
-  <record id="2" aka="AAAAAAAAAAI=">
-    <pickle>
-      <tuple>
-        <global name="Guard" module="Products.DCWorkflow.Guard"/>
-        <tuple/>
-      </tuple>
-    </pickle>
-    <pickle>
-      <dictionary>
-        <item>
-            <key> <string>roles</string> </key>
-            <value>
-              <tuple>
-                <string>Manager</string>
-                <string>Assignee</string>
-              </tuple>
-            </value>
-        </item>
-      </dictionary>
-    </pickle>
-  </record>
 </ZopeData>

bt5/erp5_banking_check/bt/revision

-375
+376
\ No newline at end of file