Sugar Pro 11.0.5 not respecting Teams?

I realize that Sugar Pro 11.0.5 is off support but bare with me...

We have never used Teams to restrict visibility. Every record is "Global" and every user has "Global"
however we have recently opted to change the visibility of Leads coming from Embargoed Countries to restrict them to a special Team called "Embargoed" so that they can be reviewed by a user assigned to that Team but not displayed/assigned to Account Executives at large.

I have a custom Logic Hook that accurately assigns the Team based on the address Country.
In the Lead record view I see only Embargoed (Primary) as the Team assigned to a particular Lead.

However, any user who is NOT part of that Team can still see the Lead records that are exclusive to that lead.

I checked the user accounts we tested with and they are all "Regular User"
I checked the Leads Module Access in the User's Roles and access is "Enabled" with
Access Type: Normal
Delete: None
Edit: All
Export: All
Import: None
List: All
Mass Update: All
Record View: All

There are no particular field level permissions (they are all "Not Set")

I do have two ACL modifications based on Enrico Simonetti's ACL Lock but none affect the Leads module.

I rebuilt Teams after adding this new team, as well as QRR, just for good measure

Is there anything else I should check?

Thank you,
FrancescaS

  • Hello 

    The behaviour that you described doesn't sound correct. 
    The causes that cross my mind are:

    1 - You've mentioned that by default " Every record is "Global". If you want to restrict the visibility from other users you'll need to remove the Global team from the Record and add the New "Embargo" team. Was that performed?  

    2- Does the user have any reportees? Is the user possibly having an Implicit team membership to the embargoed team? 
    support.sugarcrm.com/.../index.html


    3 - Do you have any customisations on custom/data/visibility/ ? 
    I've seen cases of customers disabling team security to improve performance, could that be the case? 

    4 - Did you run a repair teams already? 
    https://support.sugarcrm.com/Documentation/Sugar_Versions/13.0/Ent/Administration_Guide/System/Repair/#Repair_Teams

    Feel free to let me know if any of these guides you in the right direction or if you need any more information or ideas. 

    Thanks 

    André

  • Thank you ,

    to answer your questions:

    • I have verified that the record has one team only "Embargoed" and no others

    • I have verified that the user I use for testing does not have "Embargoed" team assigned explicitly or implicitly:
      SELECT tm.*, t.name
      FROM `team_memberships` tm
      INNER JOIN teams t ON tm.team_id = t.id
      WHERE tm.user_id = 'The_user_id_here';


      as a matter of fact no one has Team "Embargoed" assigned at this time as only Admins should be seeing these records at this time.

    • I have repaired Teams & a QRR for good measure

    • I had NOT checked the visibility customizations.
      We did have a custom/data/visibility/TeamSecurity.php (thank you for that extra tip) 
      It was added more than 5 years ago and I seriously don't remember why... 
      I removed it, QRR, and it made no difference.

    • <?php
      if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
      class TeamSecurity extends SugarVisibility
      {
              public function addVisibilityFrom(&$query)
              {
                      return $query;
              }
              public function addVisibilityFromQuery(SugarQuery $query, $options = array())
              {
                      return $query;
              }
      }


    I went as far as disabling the ACL modifications though they have nothing to do with Leads. That, as expected, did not help.

    FrancescaS

  • Hi

    I know that code! It's from our friend and forever Sugar legend .
    Look at this: 

    https://enricosimonetti.com/can-i-remove-team-security-from-sugarcrm/

    This customisation would disable the team security so it would cause the behaviour that you are experiencing. 
    If you removed and QRR and still doesn't work, can you try wiping the cache/ folder, and clearing the cache of the browser just to make sure? 

  • You rang?

    That is so funny! Thanks for bringing me temporarily back to life  Slight smile And thanks for the kind words!

    That code is 10 years old says Github, live long and prosper!

    And this might be my first post in this community in about... 8+ months since no longer being at Sugar.

    Oh wow , your system must have been flying in the breeze without team security logic!

    Now it might become a performance "shock" for you and the users if/when you add Teams filtering back...

    Vulcan tone1

    All the best friends!

    --

    Enrico Simonetti

    Sugar veteran (from 2007)

    www.naonis.tech


    Feel free to reach out for consulting regarding:

    • API Integration and Automation Services
    • Sugar Architecture
    • Sugar Performance Optimisation
    • Sugar Consulting, Best Practices and Technical Training
    • AWS and Sugar Technical Help
    • CTO-as-a-service
    • Solutions-as-a-service
    • and more!

    All active SugarCRM certifications

    Actively working remotely with customers based in APAC and in the United States

  • Ciao !
    Felice di sapere che sei ancora qui! In bocca al lupo con la nuova avventura.


    Legend is right! 

    Unfortunately that was not it.
    I deleted the entire custom/data/visibility directory, deleted the contents of the cache folder, wiped ALL the browsing data from the Chrome browser and I can STILL see the record.

    This may not be worth pursuing further until after the Enterprise conversion (sigh) and upgrade to 13... I'm still working on reviewing 12 years of customizations to get there...

    For now Sales will have to look at the Lead status and filter out the Embargoed leads.