I use a view (embedded) on a form, using the Single Category option based on the company name of a user.
I have a button on the web which launches this view (…db.nsf/9BD697F882CA3526C1656EF210564EE5?OpenView.)
It works perfect, all documents of this company are on the screen.
If a smart user enters “&RestrictToCategory=Other Company name”
behind the string, he or she can see other documents. Is there a way to disable this?
Thanks!!
MK
Subject: Here’s one method.
I added a blank Navigator document with “Looking for Something” to the page. The Navigator would open by default if the database is opened via the web. If the user tries to do what you suggested, the “Looking for Something” page appears.
Solved my problem.
Subject: Single Category in view - easy to hack???
I can think of some things that would make it more difficult to see other companies’ documents, but I don’t think that you can absolutely restrict access that way. An important thing to keep in mind about views is that they don’t provide security. If you really, really want to keep people in company A from seeing information from company B and vice versa, use Readers fields.
Subject: Reader names field only true security
I agree with the previous poster, the only true security is Reader Names fields.
I have this problem frequently, since I expose our internal operating information to our clients. But each client must see only their own data.
So every web accessible form has a ComputedReaders field (my own naming convention) that includes the client’s login name.
So what I do is actually categorize the views that they access on the web by the Reader Names field, and use this as the single category.
It works very well, and is completely secure.
I hope this helps.
—Scott Jenkins
Subject: RE: Reader names field only true security
Thanks for the suggestions!Scott, I am affraid, your solution can not help me. For example at company A there are 10 people, with login accounts and they (all 10) must be able to see the information.
When the 11th account for Company A will be created he must also see the info.
In your solution I have to re-fill the Readers fields every time a new account is created. I think my server will not like that…
Subject: Use Roles in your Readernames field, then assign names/groups to the Roles in the ACL.
Subject: Single Category in view - easy to hack???
Why not protecting the other company name documents (who can read)?Moreover, the hacker should know the name of the view…maybe have it changed to something hard…but chances for him to find th ename is quite enigmatic.