Origin of some filters in sys_queries

Mon, 23 Jul 2018 10:11:19 +0000

Hello,

We're having issues to find some items trough the "Search Company" popup (pages/Search.htm).

So we compared the queries executed for these users and discovered that some filters were added at the end of the queries :

 AND ((0 <> 0) OR EXISTS (SELECT S1.K_USER FROM ADMIN.ACC_GROUPS S1, ADMIN.COMP_USER S2 WHERE S1.K_USER = S2.K_USER AND S1.K_USER2 = 61 AND S2.K_COMPANY = COMPANIES.K_COMPANY))
 AND ((0 <> 0) OR (ROLES.K_ROLE IS NULL) OR EXISTS (SELECT S1.K_USER FROM ADMIN.ACC_GROUPS S1, ADMIN.ROLE_USER S2 WHERE S1.K_USER = S2.K_USER AND S1.K_USER2 = 61 AND S2.K_ROLE = ROLES.K_ROLE))

Example of a query executed by a user who does not find the searched item (the specific filters are in the 3 last lines) :

SELECT 
  COMPANIES.K_COMPANY,
  COMPANIES.NAME,
  COMPANIES.F_S_NAME,
  COMPANIES.VAT,
  COMPANIES.BUILDING,
  (select COUNTRY from ADMIN.LK_COUNTRY L1 where L1.K_COUNTRY=COMPANIES.COUNTRY) AS R_COUNTRY,
  COMPANIES.POSTCODE,
  COMPANIES.CITY,
  COMPANIES.STREET,
  COMPANIES.STREETNUMBER,
  COMPANIES.F_BUS,
  COMPANIES.OPENED,
  ROLE_COMP.F_TALKID,
  ROLES.F_TYPE,
  (select F_NAME_NL from ADMIN.LK_CLIENT_ROLE L2 where L2.K_CLIENT_ROLE=ROLES.F_TYPE) AS R_F_TYPE,
  (REPLACE((select REPLACE(';' +  rlr.F_N_BOEKHOUDING + ';', ';;', '') from ROLE$LR rlr join role_comp rc on rc.K_ROLE = rlr.K_ROLE and rc.K_COMPANY = COMPANIES.K_COMPANY FOR XML PATH('')), ';;', ';')) AS V_N_BOEKHOUDING_COMP,
  (REPLACE((select REPLACE(';' +  rlr.F_N_LEASEHOLD + ';', ';;', '') from ROLE$LR rlr join role_comp rc on rc.K_ROLE = rlr.K_ROLE and rc.K_COMPANY = COMPANIES.K_COMPANY FOR XML PATH('')), ';;', ';')) AS V_N_LEASEHOLD_COMP
FROM
  ADMIN.COMPANIES COMPANIES
LEFT OUTER JOIN ADMIN.ROLE_COMP ROLE_COMP ON (COMPANIES.K_COMPANY = ROLE_COMP.K_COMPANY)
LEFT OUTER JOIN ADMIN.ROLES ROLES ON (ROLE_COMP.K_ROLE = ROLES.K_ROLE)
WHERE
  (ROLES.F_TYPE IS NULL OR ROLES.F_TYPE IN (7) OR NOT EXISTS(SELECT rc.k_role FROM role_comp rc INNER JOIN roles r ON rc.k_role = r.k_role WHERE rc.k_company = companies.k_company AND r.f_type IN (7)))
  AND (
(COMPANIES.F_S_NAME like N'%710081%')
) 
 AND ((0 <> 0) OR EXISTS (SELECT S1.K_USER FROM ADMIN.ACC_GROUPS S1, ADMIN.COMP_USER S2 WHERE S1.K_USER = S2.K_USER AND S1.K_USER2 = 61 AND S2.K_COMPANY = COMPANIES.K_COMPANY))
AND ((0 <> 0) OR (ROLES.K_ROLE IS NULL) OR EXISTS (SELECT S1.K_USER FROM ADMIN.ACC_GROUPS S1, ADMIN.ROLE_USER S2 WHERE S1.K_USER = S2.K_USER AND S1.K_USER2 = 61 AND S2.K_ROLE = ROLES.K_ROLE))
ORDER BY COMPANIES.NAME

We don't know what generates these filters.

If I look for this same item, I get the following filters (the real difference is in the begin of the 2 first lines ==> "(1 <> 0)" vs "(0 <> 0)"):

AND ((1 <> 0) OR EXISTS (SELECT S1.K_USER FROM ADMIN.ACC_GROUPS S1, ADMIN.COMP_USER S2 WHERE S1.K_USER = S2.K_USER AND S1.K_USER2 = 493 AND S2.K_COMPANY = COMPANIES.K_COMPANY))
AND ((1 <> 0) OR (ROLES.K_ROLE IS NULL) OR EXISTS (SELECT S1.K_USER FROM ADMIN.ACC_GROUPS S1, ADMIN.ROLE_USER S2 WHERE S1.K_USER = S2.K_USER AND S1.K_USER2 = 493 AND S2.K_ROLE = ROLES.K_ROLE))

We looked at a lot of security options in conficy but could not find anything that could tell us what it is. The only thing we know is that if we remove those lines, we get the desired results.

Is there another place where we should look for this information ?

Kind regards,

Angel

Efficy Overflow Q&A - Recent questions tagged business-rules

Origin of some filters in sys_queries