Mass Update - Security

[aram]

I'd like to only give Admin's rights to do a Mass Update.
Is there a way?
Currently all users can add or Edit Accounts and Contacts,
and we need to keep that in place.
We just don't want a normal user Mass Updating our whole Contacts or Accounts lists

Sugar 5.0.0b

Thanks,
Aram

[dpatech]

Unfortunately not, and this is a pretty common request.

[andopes]

Hi, aram.

It is right possible and pretty easy to do:

First of all inside the module you want to restrict access create the directory views

modules/YourModule/views

Copy inside this directory the file include/MVC/View/views/view.list.php
Rename the class name from ViewList to YouModuleViewList and rename the extends from SugarView to ViewList.

Remove all functions less the display()
And rename the line

             echo $lv->display(); 
  

to

             echo $lv->display(false); 
  

That is it.

--
André Lopes
Lâmpada Global Services
Rua Bela Cintra, 299 conjunto. 51
São Paulo, SP 01415-000
tel1. 55 11 3237-3110
cel. 55 11 7636-5859
e-mail: info@lampadacrm.com.br

[aram]

Andopes..
Thanks for the reply and info..

After I make the suggested change:
"Rename the class name from ViewList to YouModuleViewList and rename the extends from SugarView to ViewList."

I get this error returned on the Contacts Listview page:

Fatal error: Class contactsviewlist: Cannot inherit from undefined class viewlist in C:\Inetpub\wwwroot\SQmailNuts\src\sugar\modules\Co ntacts\views\view.list.php on line 41

Line 41 being:

class ContactsViewList extends ViewList{

What do you think?

Aram

[SugarDev.net]

This is nonsense. This won't work for modules which already have a customized ViewList, and it's not in the proper directory.

[andopes]

Hi, aram.
I believe you have to require_once the ViewList.

Hi, SugarDev.net.

We have done it several times from custom modules and also default modules.

Cheers

--
André Lopes
Lâmpada Global Services
Rua Bela Cintra, 299 conjunto. 51
São Paulo, SP 01415-000
tel1. 55 11 3237-3110
cel. 55 11 7636-5859
e-mail: info@lampadacrm.com.br

[SugarDev.net]

You said "modules/YourModule/views", that's not in the custom directory, so it's not upgrade-safe. You should make modules/ read-only.

[dpatech]

I learn something new all the time - I stand corrected. It would seem this approach is very upgrade safe with custom modules, and MAY be ugprade-safe for standard modules if done properly.

I believe Sugar should somehow expose this setting somewhere because many people ask for this and we should not have to modify code to make it happen.

[SugarDev.net]

Like the admin only import function?

[andopes]

You said "modules/YourModule/views", that's not in the custom directory, so it's not upgrade-safe. You should make modules/ read-only.

My bad.

You could create the file into custom/

Thank you for the advice.

Cheers

--
André Lopes
Lâmpada Global Services
Rua Bela Cintra, 299 conjunto. 51
São Paulo, SP 01415-000
tel1. 55 11 3237-3110
cel. 55 11 7636-5859
e-mail: info@lampadacrm.com.br