I have an agent which uses the evaluate statement to do lookups and returns a list of docs on the web. This agent is signed with an id which can read all documents and has all roles.
When I check the “run as web user” property of the agent (my runtime security level is “do not allow restricted operations”), it does not work. I still get the same number of documents as before although the user logged in does not have access to them (due to readers field). I confirmed this by using the view.
What am I doing wrong? Or is this a security bug where the evaluate statement bypasses the “run as web user” property?
Subject: Problem with Evaluate running in agent running as web user
And what identity to you log in when you run as “web user”? Did you log in or do you run as Anonymous? Is that identity in the reader field list? From what I understood in your post the behavior sounded correct.
You can find more information on Agent Security in the Agent FAQ, there is a table at the end of “troubleshooting agents in R5 and R6” that you might find helpful.
I have a view with documents with readers items. If I look at the view from the web I see only the documents where I am included in a readers field, the way it is supposed to work.
The database contains a LotusScript agent that uses evaluate to do a @DbColumn in that view. If I check the “Run as web user” box, it returns all documents from the view, even the ones where I am not included in a (non-empty) readers field.
Subject: RE: Evaluate as web user. Any solution yet?
I too have the same exact problem. I have a LS agent set to “Run as web user”. It has an embedded Evaluate statement that performs an @dbcolumn command. The evaluate/dbcolumn command is returning column values for all documents. I expected it to only return the column values for those documents that the web user has reader access to. It appears that the dbcolumn being performed in the lotusscript agent is not validating the reader level security. Is this an agent security issue? Has anyone else experienced this?
Subject: RE: Evaluate as web user. Any solution yet?
Yes, I am having the same problem.
I have an agent set to “Run as web user.” I’m using @DbLookup inside of my Evaluate statement, and the view I’m looking up against has documents with Readers fields. The web user can read only one document in the view, yet all the documents are returned via the Evaluate statement.
I confirmed that my agent is running as the web user in all other respects. As another test, I added LotusScript in the agent to loop through the same documents in the same view. This time, only the one document is returned, like I expected.
Evaluate seems to be ignoring all Readers field security when used with @Formulas like @DbLookup and @DbColumn, in agents where Run as Web User is selected.