[Master] [Repair Item] Team Member unable to copy sales quotation when lines are associated to assembly

[Shikhverma]

Bug 630947: [ALL-E] [Repair Item] Team Member unable to copy sales quotation when lines are associated to assembly

Fixes AB#630947

[ChethanT]

Do we need all RIMD on these objects?

[Shikhverma]

Do we need all RIMD on these objects?
Changes done

[ChethanT]

Is this addressed? Fx, why do we need RIMD on Assembly Header and Assembly Line in this function?

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ Security}$

In all six layer copies of codeunit 6620 "Copy Document Mgt.", the new attribute block on procedure CopySalesShptLinesToDoc grants "Assembly Header"/"Assembly Line"/"Assemble-to-Order Link" ('RIMD') and "Posted Assembly Header"/"Posted Assembly Line" ('R'), but the procedure body directly calls FromSalesShptLine.AsmToShipmentExists(PostedAssemblyHeader), which reads table "Posted Assemble-to-Order Link" (via PostedAssembleToOrderLink.AsmExistsForPostedShipmentLine). No attribute in this procedure grants read access to "Posted Assemble-to-Order Link", so a caller relying on this attribute for authorization can still hit a runtime permission error when copying posted shipment lines that have an assemble-to-order link.

Knowledge:

• microsoft/knowledge/security/inherent-permissions-minimal-grant.md

Line mapping was unavailable, so this was posted as an issue comment.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.18.4}