Read-Only flag in CustomerCompany Map

[bschmalhofer]

I had a strange setup with additional fields in CustomerCompany. In the config these were marked as readonly. Consequently the additional fields could not be changed. Because of a direkt update in the table customer_company different values were shown in the GUI as were in the table. When updating in the GUI the values from the GUI were inserted in the table.

My guess is that the readonly fields were still POST input fields. And all it takes to make these fields writable is to use a Browser extension that make ro input fields writable. IMHO this is a security bug.

[svenoe]

Confirmed. We have to introduce a server side check, probably in the module files.

[bschmalhofer]

The readonly flag was not checked in AdminCustomerCompany.pm. The solution is to pass the old values for the readonly values.

[bschmalhofer]

Tested with Firefox Webdevelopper 'Make Form Fields Writeable' . Looks good. Closing the issue.