Entity Security (jdeveloper11.1.1.3 Functionality Change)

After Migration to new jdeveloper we found out that users that had no permissions to update entities could insert and save new records!!!???

I managed to reproduced in a simple test case with 1 entity Jobs on an editable table.
I have enabled security and I have 2 roles ‘UpdateJobs’ and ‘ViewJobs’.

I have added authorisation to entity update and delete for role UpdateJobs.


When I loggin with a user that just have ViewJobs role table rows comes read only and Delete button disabled.


Yet CreateInsert button is enabled and if I press it new row is created with updatable attributes that I can also save it without a problem.

Before last patch you could still create new row but it was not updatable.
Is this a bug?

Test case:
http://adfbugs.googlecode.com/files/TestInsertSecurity.zip
password for User and Manager : welcome1

User principal is not propagated to Middle tier. New bug on 11.1.1.3. (Fixed in 11.1.1.4)

It may be strange that a new bug like that is introduced in a bug fixing release but it can happen to the best also.

After Migrating to jdeveloper 11.1.1.3.0 you will notice that application module method getUserPrincipalName() return always ‘Anonymous’ and history columns for user are populated with null. Andrejus Baranovskis have posted about it, Steve Muench logged on Oracle Metalink - bug# 9672139 and a workaround is posted also in the comments that we also use and seams to solve the problem.
I post it also to follow upe with it.
On our base Application Module class we override the prepare session and:

@Override
protected void prepareSession(Session session) {
String contextUser = ADFContext.getCurrent().getSecurityContext().getUserName();
String envUser = (String)session.getEnvironment().get(PropertyMetadata.USER_PRINCIPAL.getName());
if (!envUser.equals(contextUser)) {
session.getEnvironment().put(PropertyMetadata.USER_PRINCIPAL.getName(),contextUser);
}

super.prepareSession(session);
}