Managed to find a solution. Maybe it should've been obvious. The ACLs work as expected if the empty string '' is added to possible values for ddFilteredField. This empty string would be equivalent to the empty value '-'. Samples: Possible => { Ticket => { DynamicField_ddFilteredField => [''] }, }, Possible => { Ticket => { DynamicField_ddFilteredField => ['', '[RegExp]^ddffA.*'] }, }, Possible => { Ticket => { DynamicField_ddFilteredField => ['', '[RegExp]^ddffB.*'] }, }, On Tue, Jul 9, 2013 at 6:18 PM, Bogdan Iosif wrote:

Hi list,

I have a problem that looks like either I'm doing something wrong with my ACLs or I ran into an untreated variation of bug#7968 that was fixed since 3.1.0.beta2 (see http://bugs.otrs.org/show_bug.cgi?id=7968).

Can someone please help identify if this is a bug and, if so, if I should reopen bug#7968 or post a new bug related to bug#7968?

=Configuration description=

I added a dynamic field (let's assume it's named ddFilteredField) of type drop down with "Add empty value" = Yes and some key/value pairs (let's assume it has: ddffAx = x, ddffAy = y, ddffBz = z).

Then I added some ACLs to achieve the following objectives:

[Objective1] For all the queues not covered by [Objective2], as well as any new future queues, show only the empty value for ddFilteredField. Sample ACL:

# Applies before others $Self->{TicketAcl}->{'1-ACL-SetDdFilteredField-RemoveAll'} = { Properties => { Frontend => { Action => ['AgentTicketFreeText'] }, }, # If the problem is on the next line, then how do I specify to leave just the empty value? Possible => { Ticket => { DynamicField_ddFilteredField => [] }, }, };

[Objective2] Depending on ticket's queue, show only some values for ddFilteredField. Sample ACLs:

$Self->{TicketAcl}->{'2-ACL-SetDdFilteredField-SituationA'} = { Properties => { Frontend => { Action => ['AgentTicketFreeText'] }, Queue => { QueueID => [1, 2] }, }, Possible => { Ticket => { DynamicField_ddFilteredField => ['[RegExp]^ddffA.*'] }, }, };

$Self->{TicketAcl}->{'3-ACL-SetDdFilteredField-SituationB'} = { Properties => { Frontend => { Action => ['AgentTicketFreeText'] }, Queue => { QueueID => [3, 4, 5] }, }, Possible => { Ticket => { DynamicField_ddFilteredField => ['[RegExp]^ddffB.*'] }, }, };

=Problem=

First I thought everything was OK. In queues for [Objective1] I saw the expected values + the empty value '-', in all the other queues I saw only the empty value '-'.

Then I noticed exactly the same [potentially dangerous] problem as described in bug#7968. During any AJAX refresh on AgentTicketFreeText, the empty value for ddFilteredField disappears and the first actual value is wrongfully auto-selected, waiting to be saved when the user clicks Submit.

Once an actual value is saved for ddFilteredField, when AgentTicketFreeText is opened the empty value will appear for ddFilteredField after the first load but it can't be selected even if the user tries to because during the post-selection AJAX request, the 1st real value is selected instead and the empty value disappears.

The same problem doesn't occur for fields that are not filtered by ACLs.

Is this a bug? Is there a workaround? See my comment for the first ACL, maybe that's where the problem is introduced.

Thanks, Bogdan