Even If With A Review Action , The Assignee (who Is Not A Team Member) Can Update Change Request (Doc ID 2131815.1)

Last updated on MARCH 08, 2017

Applies to:

Oracle Project Planning and Control - Version 12.1.3 and later
Information in this document applies to any platform.

Symptoms

On : 12.1.3 version, Change Management

Even if the Action was a Review one, the Assignee could update the change request.
The change management document in the oracle project user guide says:
  'A review action allows the assignee to review the change document and enter a response. An update action allows the assignee to update the Change document an long as the action is open'
So the assignee with a review action must not have access to modify the change request.
Step to reproduce the bug:

The owner of the change request:
  
  - Verify that the user is not a team member
  - Create a change request with the status 'WORKING'
  - Create a Review Action

The Assignee

  - Click on the notification line to have access to the action
  - Click on the button 'view change control details' to have access to the change request
  - Click on the button 'Update Change Request' to accede to change request and update it.

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms