Skip to content

BSL205 — IsInRole global method call

← All rules

Summary

IsInRole global method call

Identifiers

Field Value
Rule code BSL205
Compatible alias IsInRoleMethod
Severity WARNING
Enabled by default Yes
Implemented Yes
Tags security, access-control

Behavior

  • The public identifier BSL205 and alias IsInRoleMethod are stable.
  • The rule reports the cases documented on this page.
  • Suppressions and project configuration are applied before publication.
  • The rule requires neither an external analyzer nor network access.

Configuration and suppression

BSL### is the primary stable identifier. The compatible alias is accepted in select, ignore, and compatible block suppression comments.

[tool.onec-hbk-bsl]
select = ["BSL205"]
ignore = ["IsInRoleMethod"]

All three suppression families support both a current line and a range. When an opening comment follows code, it affects only that line. Use any one form:

  • noqa:
Value = "example";  // noqa: BSL205
  • bsl-disable:
Value = "example";  // bsl-disable: BSL205
  • compatible BSLLS form:
Value = "example";  // BSLLS:IsInRoleMethod-off

When the same opening comment is on a line by itself, it starts a range. Close it with the matching marker from the same family:

// noqa: BSL205
// code without this diagnostic
// noqa-enable: BSL205

// bsl-disable: BSL205
// code without this diagnostic
// bsl-enable: BSL205

// BSLLS:IsInRoleMethod-off
// code without this diagnostic
// BSLLS:IsInRoleMethod-on

To disable the rule until the end of the file, omit the closing noqa-enable, bsl-enable, or BSLLS:…-on marker.

Opening and closing markers must belong to the same family.

Description

To check access rights in the code, use the AccessRight method.

When a role does not grant access rights to metadata objects and defines an additional access right only, use the IsInRole method.

If Standard Subsystems Library is used in a configuration, use the RolesAvailable function of the Users common module, otherwise IsInRole method call must be combined with PrivilegedMode() method call. If Standard Subsystems Library is used in a configuration, use the RolesAvailable() function of the Users common module, otherwise IsInRole() method call must be combined with PrivilegedMode() method call.

Examples

Wrong: 

If RolesAvailable("AddingChangingCountriesWorld") Then...
If RolesAvailable("ViewPopularCountriesReport") Then ...
Correct: 
If AccessRight("Edit", Metadata.Catalogs.WorldCountries) Then ...
If AccessRight("View", Metadata.Reports.PopularCountries) Then ...
Wrong: 
If RolesAvailable("Treasurer") Then...
Сorrect: 
If IsInRole("Treasurer") OR PrivilegedMode() Then ...

Sources