Role permissions for pages
I've set up an app with a dashboard page that is open to EOTI. The purpose is for the public to see upcoming events, and register for them. It was all working great, until I realized that typing in ?a...
Forum Discussion
While it is true that they can go to those pages(I didn't know that until just now) they should not be able to see any data there. I tested this just now and I could go to the admin or any other page as the lowest role in my org but every page displayed nothing in the reports and some even said access denied.
If the report is displaying information to them then that is another issue. You should set the permissions for that EOTI role to be VERY restrictive in what tables and things they can see. If you have a table you do not want them to get info from make sure they are set to not be able to view, edit, or add to that table and if you want to go the extra mile you can make sure that is set at the field level as well. You can do that where some fields are allowed and some are not but safer way is to deny all. Only give them access to exactly the table they need and nothing else.
If the report is displaying information to them then that is another issue. You should set the permissions for that EOTI role to be VERY restrictive in what tables and things they can see. If you have a table you do not want them to get info from make sure they are set to not be able to view, edit, or add to that table and if you want to go the extra mile you can make sure that is set at the field level as well. You can do that where some fields are allowed and some are not but safer way is to deny all. Only give them access to exactly the table they need and nothing else.
How you described it above is how it works, but in the table listing the events I have a summary field of how many people have registered for the event. That summary count gets passed back to the registrant table to display on the form when someone registers, in order to calculate how many open slots for the event are available.
When the app was first set up, I had to allow view of All Records on the Roles>Permissions tab for the table in order to get that feedback of how many slots are left to work. I figured since there was no way that I knew of at the time for the users to access that table (hiding table buttons, links, etc), it would be okay, until I found the url editing trick. All the reports for the registrant table have been restricted, but table access granted so the summary field on the events table can work right for the EOTI role.
Since access to the report displaying on the admin page doesn't show up in the table reports widget, for now I've replaced the report showing all registrants with a different report that doesn't show everybody's information. This works, but makes the admin have to do a couple more clicks to get to that report that originally was on the main dashboard page. Good enough for now, but Austin if you or anyone has any additional suggestions I'd love to hear them!
Thanks for the help!
[edit] I also discovered now that if EOTI has table access the url address bar can be edited to access any of the reports for the table.
When the app was first set up, I had to allow view of All Records on the Roles>Permissions tab for the table in order to get that feedback of how many slots are left to work. I figured since there was no way that I knew of at the time for the users to access that table (hiding table buttons, links, etc), it would be okay, until I found the url editing trick. All the reports for the registrant table have been restricted, but table access granted so the summary field on the events table can work right for the EOTI role.
Since access to the report displaying on the admin page doesn't show up in the table reports widget, for now I've replaced the report showing all registrants with a different report that doesn't show everybody's information. This works, but makes the admin have to do a couple more clicks to get to that report that originally was on the main dashboard page. Good enough for now, but Austin if you or anyone has any additional suggestions I'd love to hear them!
Thanks for the help!
[edit] I also discovered now that if EOTI has table access the url address bar can be edited to access any of the reports for the table.