major
nice-to-have
defect
major
enhancement
Whether a command can be executed typically depends on its command group, the component's security object, and the component's role profile. Execution based on these authorization rules is built in and does not need to be explicitly configured.
Improvement
In some cases, it may be useful to place a command (button) outside the permission layout to which its action refers. For example, the button that opens a dialog should be tied to the permission settings of the dialog’s content, so that the dialog can only be opened if an action can actually be performed within the dialog. In many cases, this works automatically because the dialog and the component that opens it are located in the same permission layout. However, if the dialog content has its own permission layout, it may make sense to mark the dialog opener as a system command and grant it explicit security-related executability:
#!xml
<button id="openMyDialog"
class="com.top_logic.tool.boundsec.OpenModalDialogCommandHandler"
clique="create"
dialog-name="MyDialog"
group="SYSTEM"
>
<executability>
<security-check
group="CREATE"
security-component="MyDialogContent"
/>
</executability>
</button>
Test
- Dialog opener for "Create Node" (+) in the DemoTypes tree.