Access Privileges / Web Security DB field control

[Steve T.]

Hi, folks! In a recent post on FM6 [post #74002], users mentioned lasso having greater security features. I cannot seem to get the Web Security Database to allow me to limit fields by user. If I am not mistaken, however, FileMaker's Acess Privileges DOES allow you to limit users to certain fields. WSD allows you to specify user "powers" (browse/create/edit, etc.) but only seems to let you limit fields for everyone, not individual users. Is this true?

I want general public users to view certain fields only. I want higher level users to see all fields (or a greater number of them). I thought this would be a basic function in WSD but I'm stuck. Suggestions? Any feedback welcome, including corrections and/or "duh!" messages (as long as they're helpful!).

Thanxalot!

--ST

Quote:

------------------------------------------------------------------------

omiossec said:

If security is one of your problem I suggest you to use lasso.

Lasso use a database abascration layer that let the administrator to set up acces to fiedl, layout, db ... and to restrict action to the db. It aslo use inline so with this you don't have to show db name and layout name in url that prevent some hacking.

------------------------------------------------------------------------

Don't be fooled by FM Security Database settings for access to field, layout, and db ...

It looks almost like Olivier mentioned, but the difference is staggering.

--------------------

Anatoli Kohout

>>I am not unemployed. I am a consultant<<

[Anatoli]

RE: I want general public users to view certain fields only.

You have full control on your hands -- put in HTML file only the fields you want to show.

[Steve T.]

Hi, Anatoli! Yes, I thought of that but maybe I am missing something... I am accessing data and fields in FileMaker db's without referencing them in my HTML pages. I'll send you a private message with more info...

--ST

[Anatoli]

IMHO -- FM security can be elevated in 2 ways:

1. Set security to exact search and FM will not show everything.

2. Use Lasso and block FM WC in Firewall.

HTH

Anatoli

[Steve T.]

Thanx, Anatoli!

Hasn't anyone else wanted to show general public users fields A, B, and C, but not fields D, and E which should only be accessed by privileged users?

I have only used the Web Security Database for web publishing so far. but has anyone used ACCESS PRIVILEGES with Custom Web Publishing to limit users to specific field access? Of course, I don't think I can really move away from the WSD at this point (all db's have to be either AP or WSD) but I'd like to consider AP if it works well...

[Keith M. Davie]

Heh, heh. Good old ScriptMaker is a great tool.

If you use it properly you can remove data from db files run through web security, while other data can be left in files which do run through web security. Combined with many other FileMaker abilities, in this case the fmp-if and a token or two, and it should be a snap.

Heh, heh. Any competent FileMaker developer can figure it out and do it safely and securly.

There is more information in these forums on how to accomplish it than I had available to me when I figured it out. And I wasn't all that versed in FileMaker. When I did it, I had never worked in a multi-user environment.

Yup. Heh, heh, Good old ScriptMaker is a great tool. I recommend that developers learn how to use it.

[Steve T.]

Keith M. Davie said:

Heh, heh. Any competent FileMaker developer can figure it out and do it safely and securly.

Hi, Keith! Thanx for the lead but that sounds like too much work and restructuring of our db's for me to do so quickly and easily. Old hands like you shared, tested, and debated with each other for everyone's benefit through the years (yes, I've seen some of those old posts), but I'm not a professional FM developer (although I'd like to think I'm still competent) so the toil of the ScriptMaker evangelist route is a little too much for me right now and may snap my confidence rather than be a snap to do. I'll have to work my way up that. Thanxalot!