A Read-Only attribute can be saved

Products

• Clarity PPM SaaS
• Clarity PPM On Premise

Issue/Introduction

A user is able to save over Read-Only fields that were previously updated by a process.

 

Steps to reproduce

1. Create a read-only attribute to any object (e.g.: Idea object, String type attribute 'my_string') 
2. Assign it a default value (e.g.: xxx)
3. Add the attribute to an edit view (e.g.: Idea Properties Layout Edit) 
4. Create a very simple Process with Start Event 'Update' and in the Step 'Start' create a Custom Action: Script that updates attribute 'my_string' to 'yyy' 
5. Create a new Idea. Save. Idea properties layout edit view shows the value "xxx" as read-only. 
6. Get the ID number from the URL. (e.g.: 5215000)
7. Run query:
   • select my_string from odf_ca_idea where id=5215000
   • Result: my_string = xxx 
8. Using another browser, login and open the Idea you created in step 5. Change something and click on Save. 
9. Go to Process Tab. The Process you created in step 4 ran and completed 
10. Run query: 
    • select my_string from odf_ca_idea where id=5215000 
    • Result: my_string = yyy 
11. The attribute was updated fine by the Process. 
12. Go back to the first browser where you have the Idea in the General page and the attribute still shows value "xxx" as read-only. 
13. DO NOT REFRESH THE PAGE. 
14. Click on Save. 
15. Run again query: 
    • select my_string from odf_ca_idea where id=5215000 
    • Result: my_string = xxx

Expected Result: You should get error like "Attribute is not editable" because attribute my_string is a Read-Only field

Actual Result: You were able to Save over Read-Only field.

Environment

This applies to any PPM release.

Resolution

This was originally reported as internal issue CLRT-81693 and determined that this is not a bug.

By design, Read-Only attributes stop the user from updating the values from UI. In this case, when the process executes, the updates are made in the database directly hence the values are being updated on the UI as well. When the page is saved again, the values contained in the UI are saved back to the system.