[Home] [Help]
192: -- For the mean-time, two sets of person cache are maintained.
193: -- This is not ideal, but has been done to prevent regressions, both
194: -- functional and performance, using the evaluate_access method;
195: -- g_person_list will be obsoleted going forward.
196: -- Here people in hr_security_internal.g_per_tbl are added to
197: -- g_person_list for backwards compatibility.
198: --
199: PROCEDURE sync_person_cache
200: IS
205:
206: --
207: -- Sync the two sets of cache.
208: --
209: IF hr_security_internal.g_per_tbl.COUNT > 0 THEN
210: i := hr_security_internal.g_per_tbl.FIRST;
211: WHILE i <= hr_security_internal.g_per_tbl.LAST LOOP
212: g_person_list(i) := TRUE;
213: i := hr_security_internal.g_per_tbl.NEXT(i);
206: --
207: -- Sync the two sets of cache.
208: --
209: IF hr_security_internal.g_per_tbl.COUNT > 0 THEN
210: i := hr_security_internal.g_per_tbl.FIRST;
211: WHILE i <= hr_security_internal.g_per_tbl.LAST LOOP
212: g_person_list(i) := TRUE;
213: i := hr_security_internal.g_per_tbl.NEXT(i);
214: END LOOP;
207: -- Sync the two sets of cache.
208: --
209: IF hr_security_internal.g_per_tbl.COUNT > 0 THEN
210: i := hr_security_internal.g_per_tbl.FIRST;
211: WHILE i <= hr_security_internal.g_per_tbl.LAST LOOP
212: g_person_list(i) := TRUE;
213: i := hr_security_internal.g_per_tbl.NEXT(i);
214: END LOOP;
215: END IF;
209: IF hr_security_internal.g_per_tbl.COUNT > 0 THEN
210: i := hr_security_internal.g_per_tbl.FIRST;
211: WHILE i <= hr_security_internal.g_per_tbl.LAST LOOP
212: g_person_list(i) := TRUE;
213: i := hr_security_internal.g_per_tbl.NEXT(i);
214: END LOOP;
215: END IF;
216:
217: END sync_person_cache;
294:
295: --
296: -- Bug 3584578.
297: -- All supervisor security is now evaluated in
298: -- hr_security_internal.evaluate_access.
299: --
300: /* cursor get_super_people(p_top_person_id number,
301: p_max_levels number) is
302: select asg.person_id
466:
467: --
468: -- Bug 3584578.
469: -- All supervisor security is now evaluated in
470: -- hr_security_internal.evaluate_access.
471:
472: /*
473: --
474: -- look to see if we are using supervisor hierarchies
604: -- Where user-based security or assignment-level security is used,
605: -- the security is dynamically assessed, otherwise it picks up
606: -- the permissions from per_person_list.
607: --
608: -- hr_security_internal.evaluate_access keeps a separate person
609: -- cache at the moment, although it is expected that g_person_list
610: -- can be completely replaced by g_per_tbl in the near future
611: -- (this exercise requires references to g_person_list to be
612: -- replaced by g_per_tbl).
615: --
616: -- Fetch the parameters that allow different modelling options.
617: -- THESE PARAMETERS ARE FOR DEVELOPMENT USE ONLY AT PRESENT.
618: --
619: g_effective_date := hr_security_internal.get_effective_date;
620: l_what_to_evaluate := hr_security_internal.get_what_to_evaluate;
621: l_use_static_lists := hr_security_internal.get_use_static_lists;
622:
623: hr_security_internal.evaluate_access
616: -- Fetch the parameters that allow different modelling options.
617: -- THESE PARAMETERS ARE FOR DEVELOPMENT USE ONLY AT PRESENT.
618: --
619: g_effective_date := hr_security_internal.get_effective_date;
620: l_what_to_evaluate := hr_security_internal.get_what_to_evaluate;
621: l_use_static_lists := hr_security_internal.get_use_static_lists;
622:
623: hr_security_internal.evaluate_access
624: (p_person_id => g_person_id
617: -- THESE PARAMETERS ARE FOR DEVELOPMENT USE ONLY AT PRESENT.
618: --
619: g_effective_date := hr_security_internal.get_effective_date;
620: l_what_to_evaluate := hr_security_internal.get_what_to_evaluate;
621: l_use_static_lists := hr_security_internal.get_use_static_lists;
622:
623: hr_security_internal.evaluate_access
624: (p_person_id => g_person_id
625: ,p_user_id => g_user_id
619: g_effective_date := hr_security_internal.get_effective_date;
620: l_what_to_evaluate := hr_security_internal.get_what_to_evaluate;
621: l_use_static_lists := hr_security_internal.get_use_static_lists;
622:
623: hr_security_internal.evaluate_access
624: (p_person_id => g_person_id
625: ,p_user_id => g_user_id
626: ,p_effective_date => g_effective_date
627: ,p_sec_prof_rec => g_context
657:
658: -- remove the current user if required.
659: if g_context.exclude_person_flag='Y' then
660: --g_person_list.delete(g_person_id);--6012095 (Forward port of 5985232)
661: hr_security_internal.g_per_tbl.delete(g_person_id);
662: end if;
663: --
664:
665: END IF;
955: initialise_globals;
956: END IF;
957: --
958: -- return g_person_list.exists(p_person_id); -- Fixed for bug 5985232
959: return hr_security_internal.g_per_tbl.exists(p_person_id); -- Fixed for bug 5985232 (6320769)
960:
961: END check_person_list;
962: --
963: -- Added for Bug 8465433
974:
975: IF globals_need_refreshing THEN
976: initialise_globals;
977: END IF;
978: return hr_security_internal.g_vac_per_tbl.exists(p_person_id);
979:
980: END check_vac_person_list;
981: --
982: -----------------------------------------------------------------------
1238:
1239: -- If security evaluation was deferred at logon, or if the person/
1240: -- assignment permissions are unknown for some other reason, use
1241: -- caching on demand to evaluate permissions on the fly.
1242: if not hr_security_internal.per_access_known then
1243: -- Passing a value to p_what_to_evaluate avoids evaluating
1244: -- permissions for irrelevant security criteria.
1245: hr_security_internal.evaluate_access(
1246: p_person_id => g_person_id
1241: -- caching on demand to evaluate permissions on the fly.
1242: if not hr_security_internal.per_access_known then
1243: -- Passing a value to p_what_to_evaluate avoids evaluating
1244: -- permissions for irrelevant security criteria.
1245: hr_security_internal.evaluate_access(
1246: p_person_id => g_person_id
1247: ,p_user_id => g_user_id
1248: ,p_effective_date => g_effective_date
1249: ,p_sec_prof_rec => g_context
1246: p_person_id => g_person_id
1247: ,p_user_id => g_user_id
1248: ,p_effective_date => g_effective_date
1249: ,p_sec_prof_rec => g_context
1250: ,p_what_to_evaluate => hr_security_internal.g_per_sec_only);
1251: -- The two sets of person cache are synched.
1252: --sync_person_cache;--Fixed for bug 6012095(Fwd port of 5985232)
1253: --
1254: end if;
1390:
1391: -- If security evaluation was deferred at logon, or if the person/
1392: -- assignment permissions are unknown for some other reason, use
1393: -- caching on demand to evaluate permissions on the fly.
1394: -- if not hr_security_internal.per_access_known then - sshr perf issue
1395: -- Passing a value to p_what_to_evaluate avoids evaluating
1396: -- permissions for irrelevant security criteria.
1397: hr_security_internal.evaluate_access(
1398: p_person_id => g_person_id
1393: -- caching on demand to evaluate permissions on the fly.
1394: -- if not hr_security_internal.per_access_known then - sshr perf issue
1395: -- Passing a value to p_what_to_evaluate avoids evaluating
1396: -- permissions for irrelevant security criteria.
1397: hr_security_internal.evaluate_access(
1398: p_person_id => g_person_id
1399: ,p_user_id => g_user_id
1400: ,p_effective_date => g_effective_date
1401: ,p_sec_prof_rec => g_context
1398: p_person_id => g_person_id
1399: ,p_user_id => g_user_id
1400: ,p_effective_date => g_effective_date
1401: ,p_sec_prof_rec => g_context
1402: ,p_what_to_evaluate => hr_security_internal.g_per_sec_only
1403: ,p_top_person_id => p_top_person_id);
1404: -- The two sets of person cache are synched.
1405: --sync_person_cache;--Fixed for bug 6012095(Fwd port of 5985232)
1406: --
1499: -- or if the person / assignment permissions are unknown for
1500: -- some other reason, use caching on demand to evaluate
1501: -- permissions on the fly.
1502: --
1503: IF NOT hr_security_internal.per_access_known THEN
1504: --
1505: -- Passing a value to p_what_to_evaluate avoids evaluating
1506: -- permissions for irrelevant security criteria.
1507: --
1504: --
1505: -- Passing a value to p_what_to_evaluate avoids evaluating
1506: -- permissions for irrelevant security criteria.
1507: --
1508: hr_security_internal.evaluate_access
1509: (p_person_id => g_person_id
1510: ,p_user_id => g_user_id
1511: ,p_effective_date => g_effective_date
1512: ,p_sec_prof_rec => g_context
1509: (p_person_id => g_person_id
1510: ,p_user_id => g_user_id
1511: ,p_effective_date => g_effective_date
1512: ,p_sec_prof_rec => g_context
1513: ,p_what_to_evaluate => hr_security_internal.g_PER_SEC_ONLY);
1514:
1515: --
1516: -- The two sets of person cache are synched.
1517: --
1602: -- or if the person / assignment permissions are unknown for
1603: -- some other reason, use caching on demand to evaluate
1604: -- permissions on the fly.
1605: --
1606: -- IF NOT hr_security_internal.per_access_known THEN - SSHR PERF ISSUE
1607: --
1608: -- Passing a value to p_what_to_evaluate avoids evaluating
1609: -- permissions for irrelevant security criteria.
1610: --
1607: --
1608: -- Passing a value to p_what_to_evaluate avoids evaluating
1609: -- permissions for irrelevant security criteria.
1610: --
1611: hr_security_internal.evaluate_access
1612: (p_person_id => g_person_id
1613: ,p_user_id => g_user_id
1614: ,p_effective_date => g_effective_date
1615: ,p_sec_prof_rec => g_context
1612: (p_person_id => g_person_id
1613: ,p_user_id => g_user_id
1614: ,p_effective_date => g_effective_date
1615: ,p_sec_prof_rec => g_context
1616: ,p_what_to_evaluate => hr_security_internal.g_PER_SEC_ONLY
1617: ,p_top_person_id => p_top_person_id);
1618:
1619: --
1620: -- The two sets of person cache are synched.
1755: -- or if the person / assignment permissions are unknown for
1756: -- some other reason, use caching on demand to evaluate
1757: -- permissions on the fly.
1758: --
1759: IF NOT hr_security_internal.per_access_known THEN
1760: --
1761: -- Passing a value to p_what_to_evaluate avoids evaluating
1762: -- permissions for irrelevant security criteria.
1763: --
1760: --
1761: -- Passing a value to p_what_to_evaluate avoids evaluating
1762: -- permissions for irrelevant security criteria.
1763: --
1764: hr_security_internal.evaluate_access
1765: (p_person_id => g_person_id
1766: ,p_user_id => g_user_id
1767: ,p_effective_date => g_effective_date
1768: ,p_sec_prof_rec => g_context
1765: (p_person_id => g_person_id
1766: ,p_user_id => g_user_id
1767: ,p_effective_date => g_effective_date
1768: ,p_sec_prof_rec => g_context
1769: ,p_what_to_evaluate => hr_security_internal.g_PER_SEC_ONLY);
1770:
1771: --
1772: -- The two sets of person cache are synched.
1773: --
1780: -- the assignments list, rather than the person list.
1781: --
1782: IF NVL(g_context.restrict_on_individual_asg, 'N') = 'Y'
1783: THEN
1784: IF hr_security_internal.g_asg_tbl.EXISTS(p_assignment_id) THEN
1785: RETURN 'TRUE';
1786: ELSE
1787: RETURN 'FALSE';
1788: END IF;
1788: END IF;
1789: ELSE
1790: --
1791: -- For safety, continue using check_person_list rather than
1792: -- referencing hr_security_internal.g_per_tbl until
1793: -- evaluate_access does all the work.
1794: --
1795: IF check_person_list(p_person_id) THEN
1796: RETURN 'TRUE';
1851: -- or if the person / assignment permissions are unknown for
1852: -- some other reason, use caching on demand to evaluate
1853: -- permissions on the fly.
1854: --
1855: -- IF NOT hr_security_internal.per_access_known THEN - sshr perf issue
1856: --
1857: -- Passing a value to p_what_to_evaluate avoids evaluating
1858: -- permissions for irrelevant security criteria.
1859: --
1856: --
1857: -- Passing a value to p_what_to_evaluate avoids evaluating
1858: -- permissions for irrelevant security criteria.
1859: --
1860: hr_security_internal.evaluate_access
1861: (p_person_id => g_person_id
1862: ,p_user_id => g_user_id
1863: ,p_effective_date => g_effective_date
1864: ,p_sec_prof_rec => g_context
1861: (p_person_id => g_person_id
1862: ,p_user_id => g_user_id
1863: ,p_effective_date => g_effective_date
1864: ,p_sec_prof_rec => g_context
1865: ,p_what_to_evaluate => hr_security_internal.g_PER_SEC_ONLY
1866: ,p_top_person_id => p_top_person_id);
1867:
1868: --
1869: -- The two sets of person cache are synched.
1877: -- the assignments list, rather than the person list.
1878: --
1879: IF NVL(g_context.restrict_on_individual_asg, 'N') = 'Y'
1880: THEN
1881: IF hr_security_internal.g_asg_tbl.EXISTS(p_assignment_id) THEN
1882: RETURN 'TRUE';
1883: ELSE
1884: RETURN 'FALSE';
1885: END IF;
1885: END IF;
1886: ELSE
1887: --
1888: -- For safety, continue using check_person_list rather than
1889: -- referencing hr_security_internal.g_per_tbl until
1890: -- evaluate_access does all the work.
1891: --
1892: IF check_person_list(p_person_id) THEN
1893: RETURN 'TRUE';
1933: -- or if organization permissions are unknown for
1934: -- some other reason, use caching on demand to evaluate
1935: -- permissions on the fly.
1936: --
1937: IF NOT hr_security_internal.org_access_known THEN
1938: --
1939: -- Passing a value to p_what_to_evaluate avoids evaluating
1940: -- permissions for non-org security criteria.
1941: --
1938: --
1939: -- Passing a value to p_what_to_evaluate avoids evaluating
1940: -- permissions for non-org security criteria.
1941: --
1942: hr_security_internal.evaluate_access
1943: (p_person_id => g_person_id
1944: ,p_user_id => g_user_id
1945: ,p_effective_date => g_effective_date
1946: ,p_sec_prof_rec => g_context
1943: (p_person_id => g_person_id
1944: ,p_user_id => g_user_id
1945: ,p_effective_date => g_effective_date
1946: ,p_sec_prof_rec => g_context
1947: ,p_what_to_evaluate => hr_security_internal.g_ORG_SEC_ONLY);
1948: END IF;
1949:
1950: IF hr_security_internal.g_org_tbl.EXISTS(p_organization_id) THEN
1951: RETURN 'TRUE';
1946: ,p_sec_prof_rec => g_context
1947: ,p_what_to_evaluate => hr_security_internal.g_ORG_SEC_ONLY);
1948: END IF;
1949:
1950: IF hr_security_internal.g_org_tbl.EXISTS(p_organization_id) THEN
1951: RETURN 'TRUE';
1952: ELSE
1953: RETURN 'FALSE';
1954: END IF;
1984: -- or if position permissions are unknown for
1985: -- some other reason, use caching on demand to evaluate
1986: -- permissions on the fly.
1987: --
1988: IF NOT hr_security_internal.pos_access_known THEN
1989: --
1990: -- Passing a value to p_what_to_evaluate avoids evaluating
1991: -- permissions for non-pos security criteria.
1992: --
1989: --
1990: -- Passing a value to p_what_to_evaluate avoids evaluating
1991: -- permissions for non-pos security criteria.
1992: --
1993: hr_security_internal.evaluate_access
1994: (p_person_id => g_person_id
1995: ,p_user_id => g_user_id
1996: ,p_effective_date => g_effective_date
1997: ,p_sec_prof_rec => g_context
1994: (p_person_id => g_person_id
1995: ,p_user_id => g_user_id
1996: ,p_effective_date => g_effective_date
1997: ,p_sec_prof_rec => g_context
1998: ,p_what_to_evaluate => hr_security_internal.g_POS_SEC_ONLY);
1999: END IF;
2000:
2001: IF hr_security_internal.g_pos_tbl.EXISTS(p_position_id) THEN
2002: RETURN 'TRUE';
1997: ,p_sec_prof_rec => g_context
1998: ,p_what_to_evaluate => hr_security_internal.g_POS_SEC_ONLY);
1999: END IF;
2000:
2001: IF hr_security_internal.g_pos_tbl.EXISTS(p_position_id) THEN
2002: RETURN 'TRUE';
2003: ELSE
2004: RETURN 'FALSE';
2005: END IF;
2035: -- or if payroll permissions are unknown for
2036: -- some other reason, use caching on demand to evaluate
2037: -- permissions on the fly.
2038: --
2039: IF NOT hr_security_internal.pay_access_known THEN
2040: --
2041: -- Passing a value to p_what_to_evaluate avoids evaluating
2042: -- permissions for non-pos security criteria.
2043: --
2040: --
2041: -- Passing a value to p_what_to_evaluate avoids evaluating
2042: -- permissions for non-pos security criteria.
2043: --
2044: hr_security_internal.evaluate_access
2045: (p_person_id => g_person_id
2046: ,p_user_id => g_user_id
2047: ,p_effective_date => g_effective_date
2048: ,p_sec_prof_rec => g_context
2045: (p_person_id => g_person_id
2046: ,p_user_id => g_user_id
2047: ,p_effective_date => g_effective_date
2048: ,p_sec_prof_rec => g_context
2049: ,p_what_to_evaluate => hr_security_internal.g_PAY_SEC_ONLY);
2050: END IF;
2051:
2052: IF hr_security_internal.g_pay_tbl.EXISTS(p_payroll_id) THEN
2053: RETURN 'TRUE';
2048: ,p_sec_prof_rec => g_context
2049: ,p_what_to_evaluate => hr_security_internal.g_PAY_SEC_ONLY);
2050: END IF;
2051:
2052: IF hr_security_internal.g_pay_tbl.EXISTS(p_payroll_id) THEN
2053: RETURN 'TRUE';
2054: ELSE
2055: RETURN 'FALSE';
2056: END IF;
2472: IF NOT g_mo_org_sec_known THEN
2473: --
2474: -- Re-evaluate organization security using the g_mo_context.
2475: --
2476: hr_security_internal.evaluate_access
2477: (p_person_id => g_mo_person_id
2478: ,p_user_id => g_user_id
2479: ,p_effective_date => g_effective_date
2480: ,p_sec_prof_rec => g_mo_context
2477: (p_person_id => g_mo_person_id
2478: ,p_user_id => g_user_id
2479: ,p_effective_date => g_effective_date
2480: ,p_sec_prof_rec => g_mo_context
2481: ,p_what_to_evaluate => hr_security_internal.g_ORG_SEC_ONLY);
2482:
2483: --
2484: -- Set this flag so that the permissions are not re-evaluated
2485: -- with each function call. This flag is reset back to false
2489: g_mo_org_sec_known := TRUE;
2490:
2491: END IF;
2492:
2493: IF hr_security_internal.g_org_tbl.EXISTS(p_org_id) THEN
2494: RETURN 'TRUE';
2495: ELSE
2496: RETURN 'FALSE';
2497: END IF;
2520: NVL(g_context.restrict_on_individual_asg, 'N') = 'Y' AND
2521: p_person_id IS NOT NULL AND
2522: p_assignment_id IS NOT NULL
2523: THEN
2524: hr_security_internal.g_asg_tbl(p_assignment_id) := p_person_id;
2525: END IF;
2526:
2527: end add_assignment;
2528: --
2541: --
2542: if g_context.view_all_flag <> 'Y' then
2543: --
2544: --g_person_list(p_person_id) := TRUE;--6012095(Forward port of 5985232)
2545: hr_security_internal.g_per_tbl(p_person_id) := TRUE;
2546: --
2547: end if;
2548: --
2549: end add_person;
2555: procedure remove_person(p_person_id number) is
2556: begin
2557: if g_context.view_all_flag<>'Y' then
2558: -- g_person_list.delete(p_person_id); --6012095(Forward port of 5985232)
2559: hr_security_internal.g_per_tbl.delete(p_person_id);
2560: end if;
2561: end remove_person;
2562: --
2563: -----------------------------------------------------------------------
2577: IF g_context.view_all_flag <> 'Y' AND
2578: g_context.view_all_organizations_flag = 'N' AND
2579: p_organization_id IS NOT NULL
2580: THEN
2581: hr_security_internal.g_org_tbl(p_organization_id) := TRUE;
2582: END IF;
2583: --
2584: IF (NVL(g_context.top_organization_method, 'S') <> 'U') THEN
2585: hr_security_internal.add_org_to_security_list(p_security_Profile_id,
2581: hr_security_internal.g_org_tbl(p_organization_id) := TRUE;
2582: END IF;
2583: --
2584: IF (NVL(g_context.top_organization_method, 'S') <> 'U') THEN
2585: hr_security_internal.add_org_to_security_list(p_security_Profile_id,
2586: p_organization_id);
2587: END IF;
2588: --
2589: end add_organization;
2606: IF g_context.view_all_flag <> 'Y' AND
2607: g_context.view_all_positions_flag = 'N' AND
2608: p_position_id IS NOT NULL
2609: THEN
2610: hr_security_internal.g_pos_tbl(p_position_id) := TRUE;
2611: END IF;
2612: --
2613: IF (NVL(g_context.top_position_method, 'S') <> 'U') THEN
2614: hr_security_internal.add_pos_to_security_list(p_security_profile_id,
2610: hr_security_internal.g_pos_tbl(p_position_id) := TRUE;
2611: END IF;
2612: --
2613: IF (NVL(g_context.top_position_method, 'S') <> 'U') THEN
2614: hr_security_internal.add_pos_to_security_list(p_security_profile_id,
2615: p_position_id);
2616: END IF;
2617: --
2618: end add_position;
2634: IF g_context.view_all_flag <> 'Y' AND
2635: g_context.view_all_payrolls_flag = 'N' AND
2636: p_payroll_id IS NOT NULL
2637: THEN
2638: hr_security_internal.g_pay_tbl(p_payroll_id) := TRUE;
2639: END IF;
2640:
2641: end add_payroll;
2642: --
2715: --
2716: PROCEDURE delete_list_for_bg(p_business_group_id NUMBER)
2717: IS
2718: BEGIN
2719: hr_security_internal.delete_security_list_for_bg(p_business_group_id);
2720: END;
2721: --
2722: --
2723: PROCEDURE delete_per_from_list(p_person_id number)
2722: --
2723: PROCEDURE delete_per_from_list(p_person_id number)
2724: IS
2725: BEGIN
2726: hr_security_internal.delete_per_from_security_list(p_person_id);
2727: END;
2728: --
2729: --
2730: PROCEDURE delete_org_from_list(p_organization_id number)
2729: --
2730: PROCEDURE delete_org_from_list(p_organization_id number)
2731: IS
2732: BEGIN
2733: hr_security_internal.delete_org_from_security_list(p_organization_id);
2734: END;
2735: --
2736: --
2737: PROCEDURE delete_pos_from_list(p_position_id number)
2736: --
2737: PROCEDURE delete_pos_from_list(p_position_id number)
2738: IS
2739: BEGIN
2740: hr_security_internal.delete_pos_from_security_list(p_position_id);
2741: END;
2742: --
2743: --
2744: PROCEDURE delete_payroll_from_list(p_payroll_id number)
2743: --
2744: PROCEDURE delete_payroll_from_list(p_payroll_id number)
2745: IS
2746: BEGIN
2747: hr_security_internal.delete_pay_from_security_list(p_payroll_id);
2748: END;
2749: --
2750: --
2751: -------------------------------------------------------------------------