getting api before save to run when doing mass update.

[jamie]

its quite important that my users can't find an easy way around the validation rules and not having them run before mass update is a major hole that they will exploite so quickly its hardly worth me making any validation at all

so how do i get the validation to run before mass update?

[yuri]

Mass update does not apply API before save script. It applies field level validations and assignment permission checks. For such cases, there are a few options:

• Forbid mass update for users (in Roles).
• Forbid mass update for particular fields (in metadata > entityDefs > fields).
• Disable mass update for a particular entity type (in metadata > recordDefs).
• Add an ORM-level before save hook that will do validation again and throw an error.

[yuri]

I think, we will need to expose field-level "massUpdateDisabled" parameter in the Entity Manager in future.

How PHPStorm shows documentation for metadata parameters:

[jamie]

so there is no way to get validation rules to apply to mass updates? That is really what is needed

[rabii]

i have checked code and it seems that massupdate does apply validation to both front end and back end see below


front end

https://github.com/espocrm/espocrm/blob/f860cd75aa6462eabf998b2cf2d84c2d86263d32/client/src/views/modals/mass-update.js#L275

backend

https://github.com/espocrm/espocrm/blob/f860cd75aa6462eabf998b2cf2d84c2d86263d32/application/Espo/Tools/MassUpdate/Processor.php#L189

unless you mean something different

[jamie]

rabii but then why does yuri say it doesn't?

[rabii]

jamie

Yuri said this

Mass update does not apply API before save script. 

which is true and what i said is that based on code i have checked massupdate action does go through the validation process as i shared with code above unless if i am missing something. in all case Yuri is the lead developer he knows espocrm better than anyone so you should always take his words as source of truth

I have tested this - so in the Account the name field has pattern $noBadCharacters and when you try to mass update the name of the accounts using something that trigger this pattern it will through a validation error - see below screenshot - meaning you just need to tighten your validation for fields and users won't be able to skip this in massupdate