Skip to content

ImageMovePopup context validation and security check

This operation resolves a Claim or Policy context number to display the worker's name (or "Confidential" if access is denied), enforces AD-group-based claim and image security, and optionally captures a notify task alongside confirming an image-move request.

Field Value
Operation ID OP-3
Trigger Hosting page sets Active = True and ImageFileCode ("CLAIM" or otherwise treated as policy context).
Inputs ImageFileCode, txtContextNum, txtNotifyID, wdteNotifyDate, txtNotifyText
Outputs ConfirmAction(Confirm, ImageMoveEventArgs); public CheckImageSecurity/CheckClaimSecurity boolean/out-parameter authorization results
Primary components ImageMovePopup.EditContext, ImageMovePopup.CheckClaimSecurity, ImageMovePopup.CheckImageSecurity, ImageMovePopup.SetSecurityUserImage, ImageMovePopup.EditAlertControls, ImageMovePopup.SaveButtonClick
Entry point SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb

Steps

  1. On txtContextNum TextChanged (auto-postback), RetrieveName() calls EditContext().
  2. EditContext():
  3. If ImageFileCode = "CLAIM", calls GetClaimData() → clsClaimData.GetData(DataPortalInfo, contextNum) (referenced package call, not traced further)**.
  4. If the claim is found, calls CheckClaimSecurity(MyClaimData.Security, String.Empty, AccessAllowed, LastError) (BR-IMG-001):
    • Domain gate: if mySecurity.Domain <> "SAIF", denies unconditionally (BR-IMG-004).
    • Else evaluates up to 4 claim-security flags (IsConflict, IsExposure, IsHealthIssue, IsHostileWorker) against the corresponding AD resources (BR-IMG-002, BR-IMG-003).
    • On failure of any check, masks the worker's name as "Confidential" and sets ErrorMsg.
  5. Otherwise (non-"CLAIM" context), calls GetPolicyData() → clsPolicyData.GetPolicyData(DataPortalInfo, policyNum) and shows MyPolicyData.PolicyName if found, else MSG_WAR_NO_POLICY; no analogous security check exists for the policy path*.
  6. EditAlertControls() validates the optional notify task (BR-POPUP-003):
  7. If txtNotifyText has content, txtNotifyID must also be non-empty (else MSG_ENTER_VALID_NOTIFY_ID).
  8. A non-empty wdteNotifyDate cannot be earlier than today (else MSG_NOTIFY_DATE_PRIOR_TO_TODAY).
  9. Render() calls SetSecurityUserImage() to populate the ImageSecurity cached-flags structure from clsSecurityPrincipal.IsAuthorized(...) for each ADSG_* resource name; the resulting myImageSecurity fields are not observed to gate any rendering decision beyond population**. The popup is then positioned and rendered.
  10. On cmdSave click, SaveButtonClick() re-runs EditContext() then EditAlertControls(); only if both succeed does it raise ConfirmAction(True, New ImageMoveEventArgs(contextNum, notifyID, notifyDate, notifyText)).
  11. On cmdCancel click, raises ConfirmAction(False, ...) with current field values and calls ResetControls().
  12. Public method CheckImageSecurity(inImageFileCode, inMailId):
  13. Returns True unconditionally for a fixed allow-list of system mailboxes (BR-IMG-005).
  14. If inMailId equals the current user, returns the cached myImageSecurity.HasImage flag (BR-IMG-006).
  15. Otherwise, delegates to ImageServices.HasADAccessToImageResource(inImageFileCode, inMailId) (external/referenced call, not traced further)**.

Process flow

The following diagram visualizes the context validation and security check flow.

flowchart TD
    Start([txtContextNum TextChanged]) --> Edit[EditContext]
    Edit --> Type{ImageFileCode = CLAIM?}
    Type -->|Yes| Claim[GetClaimData]
    Claim --> Sec[CheckClaimSecurity]
    Sec --> Domain{Domain = SAIF?}
    Domain -->|No| Deny([Deny outright])
    Domain -->|Yes| Flags{Any claim flag fails resource check?}
    Flags -->|Yes| Mask([Show Confidential, set ErrorMsg])
    Flags -->|No| ShowName([Show worker name])
    Type -->|No| Policy[GetPolicyData, show PolicyName]
    ShowName --> Alert[EditAlertControls validates notify fields]
    Mask --> Alert
    Policy --> Alert
    Alert --> Save{cmdSave clicked}
    Save -->|Valid| Confirm([ConfirmAction True with ImageMoveEventArgs])
    Save -->|Invalid| Blocked([Popup stays active, ErrorMsg shown])

Failure and edge-case behavior

  • Non-"SAIF"-domain callers are denied claim access unconditionally, independent of the 4 flag-level checks (BR-IMG-004).
  • When claim access is denied, EditContext() sets the UI-bound ErrorMsg to the generic MSG_WAR_NO_CLAIM rather than the more specific MSG_NOT_AUTH_CLAIM/LastError value returned by CheckClaimSecurity — whether this is intentional is unconfirmed*.
  • The policy-context branch performs no equivalent ownership/security check before displaying MyPolicyData.PolicyName*.

Sources

  • SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.vb
  • SAIF.Presentation.Web.Controls.PopUps.Infragistics111\ImageMovePopup.ascx