ODI View Access Appears to Incorrectly Allow Users to Modify Variable Expressions (Doc ID 2341059.1)

Last updated on JUNE 16, 2022

Applies to:

Oracle Data Integrator - Version 12.2.1.2.6 to 12.2.1.3.0 [Release 12c]
Information in this document applies to any platform.

Symptoms

Oracle Data Integrator (ODI) allows for different access privileges to user accounts.

A "Guest" user is configured with read-only access to variables. However, the user appears to be able to make modifications to the Expression on the "Refreshing" tab. The user can press the "Save" button without an error message, and the modification appears to be saved. However, when refreshing the variable (by closing and opening it), the modification is reverted back to the original value, and the variable modification is not actually saved (which is correct).

The user should not be able to modify the expression or anything about the variable in the first place. As read-only access, the user should only be able to view and export, but not edit it.

To reproduce:

A. Create the Guest User

Log into Studio as a supervisor
Duplicate "NG Designer" Profile, ie "Guest - NG Designer"
Go To "Authorization" tab
Select Object Variables, and unselect all options. Select only "View" and "Export"
Select Object "User Functions", and unselect all options. Select only "View" and "Export"
NOTE: for the purpose of this test we have left all other default settings
Save the profile
Create a new user "Guest"
Assign the following profiles to user:
CONNECT, CONSOLE, Guest - NG Designer

B. Modify the Variable

Log into Studio as the new guest user.
In Designer tab, expand a project, ie "TEST"
Expand "Variables" and open a Variable, ie: "V_CHECK_STATUS"
Go to "Refreshing" tab, notice that everything is "greyed out" usually indicating that no changes can be done
Click the "Pencil" icon
Make changes in "Edit Expression" , ie add "abc"
Select OK
Observe that the change made appears in the "Select Query"
Save the Variable, notice that "Select Query" still shows "abc"
Close the Variable and open it again
Notice that the "Select Query" on the "Refreshing" tab is reverted back to the original setting