Why do certain users can see documents they are not supposed to see

HCL Domino Domino Forum
1

I’m sorry to repost this problem again and again, but I still have no solution. I tried many things and read everything about this topic but I haven’t found someone with similar problem.I’m gonna explain as much as I can about this problem.

I have a form (FormA) and a view (ViewA). The view is based on the $$ViewTemplateDefault. Documents made with FormA are displayed in ViewA. I have 5 testusers all with author-access. Every user has a manager and a secretary.

Limits:

-a user can read his own document, but not modify it

-the manager of the user can read and modify it

-the secretary of the user can read it, but not modify

-users with the [ResponsbleApp] role can read and modify it

Two fields:

This two fields are computed when composed (but I also tried editable), the code beneath here is the default value of the fields. The reader field is off course reader and the author field is author.

Reader_Field:

@UserName:

@DbLookup(“”;“”:“names.nsf”;“People_DPCT”;@Name([CN];@UserName);5):

“[server]”:

“LocalDomainServers”

The dblookup gets the name of the users secretary.

Author_Field:

“[ResponsableApp]” :

@DbLookup(“”; “” : “names.nsf”; “People_DPCT”; @Name([CN];@UserName); 3)

The dblookup gets the name of the users manager.

Now, it’s a web application and every time I start it, there’s asked for a username and password. (Don’t know if this matters in the problem)

If userA creates a document, there are several users who can not see that document. But they do (allthough they can not read or edit it, but they see it in the view). Why? If that user creates his own document and goes back to the view, then the document he couldn’t see disappeared…

I also checked the document properties in lotus preview and that’s okay to. The names in the reader and author field have the CN=… .

I really don’t know what is wrong, but there has to be something. What am I missing? It can’t be that difficult to create reader and author fields that work properly.

I hope this is enough information for someone to help me.

thanks in advance

regards

2

Subject: why do certain users can see documents they are not supposed to see

Who, exactly, can see documents that they shouldn’t be able to? Double-check the stupid stuff first: make sure there aren’t any other readers or authors fields on the form, make sure you don’t have any weird security properties set on the form (not a public access document, “all readers and above” is checked), and make sure the people in question aren’t assigned to those roles and that they aren’t members of groups assigned to those roles.

Once you’ve done that, add some columns to the view displaying reader_field and author_field to make sure the contents of those fields are what you think they are when accessed on the web. Post an example or two here so we can see if anything’s obviously wrong.

3

Subject: RE: why do certain users can see documents they are not supposed to see

First off all, thanks for your response.Well, I have 5 users.

I’m gonna write them down. (1 means username, 2 means manager, 3 means secretary)

User A:

1.Bram Pirotte/thyssen 2. Manager Pirotte/thyssen 3. Secret Pirotte/thyssen

User B:

  1. Manager Pirotte/thyssen 2. Bram Pirotte/thyssen 3. Secret Pirotte/thyssen

User C:

  1. Secret Pirotte/thyssen 2. Manager Pirotte/thyssen 3. /

User D:

  1. Test Gebruiker/thyssen 2. Manager Pirotte/thyssen 3. Secret Pirotte/thyssen

This user also has the [ResponsableApp] role, so he should be able so see, read, edit every document.

User E:

  1. Test2 Gebruiker/thyssen 2. Manager Pirotte/thyssen 3. Secret Pirotte/thyssen

I made the columns in the view to display the reader and author field. And the values are correct. I also checked the other things you mentioned and everything seems to be ok.

To give you some examples:

User A opens the application on the web. He creates a new document and saves it. I close the window. User E (who can’t see the documents of user A) open the application on the web and he does see the document I just created with user A. Now, when user E makes a new document, saves it and returns to the view he can only see his own document (like it’s supposed to be)

This example is what happens with every user who can’t see another user’s document.

Now there’s user D, and it happens if he logs on there are no documents. When he creates one and goes back to the view, all of the sudden he can see every document.

Hope this is enough? Else you just aske me.

regards

4

Subject: Does he see the document or just that it is in the view Categories?

Can he click and open the document?

5

Subject: RE: Does he see the document or just that it is in the view Categories?

I found out what the real problem is. When I open my web application, I see the view that was open the last time I used the application. So the view isn’t refreshed when I open my application, because after creating a document everything was okay.

Now, how can I refresh this view?

regards and thanks for your responses