Object timeline: label connector, query and permission gaps

How the object timeline works through the shared label connector, the connector browser and timeline mode, the tables used, and the missing function permission and content scope checks.

The object timeline is a cross-object timeline through the shared label connector (label_link.value_norm): a connector browser (label, value, count), or all objects of one connector in chronological order (date, type, title, amount, link). It only reads.

Data used

Table names carry the installation's own prefix in the database.

label_link, label, label_description, entry, invoice_item and the domain models' getters.

Behaviour

  • list: filter by group and search; timeline mode when filter_label_id + filter_value_norm are given.
  • debug: the filter_sql=1 switch.

Permissions

  • The menu item is shown according to canSee(timeline, list). The list key is an unclassified row in the feature catalogue.
  • The list only checks the basic access permission; there is no canAction(list) and no content scope; the page's entry endpoint checks no permission. The debug key is checked with canAction(debug).

Known limitations

Without content scope the timeline shows the objects of every company that carry the connector.

Related topics

Related topics: timeline label dimension content scope
Request consultation Back to home
Topics
content scope (9) background job (5) permissions (5) scheduling (3) software update (3) installation (2) log (2) report (2) label dimension (2) task management (2) update (1) backup (1) release (1) notification (1) sql query (1) cache (1) integrity check (1) portal (1) turnover (1) timeline (1)