securing user input

[Luke Daniel]

Okay, well I've just found this super helpful forum on the web so I'm hoping i can take advantage of it!

I work for an NGO in social services and am looking to develop a clients case notes database.

I currently have three tables. one for casenotes, one for general info, and one for account keeping info.

I'd like to secure information in the case notes table based upon the Id of the person who lodged the case note.

How could I do this? I have currently created just 2 user accounts to play around with and want to set it so if user 1 has been assigned client X, the only user 1 can read and edit there case notes. other users should have access to other tables information...

possible? I'm guessing so.

[Vaughan]

Yes, very possible.

Read up on creating privilege sets and record level access privileges.

Also read up on the Get( AccountName ) function.

Basically, each record needs an "AccountName" field that stores the account name of the person who lodged the case note. This should be a text field that auto-enters the account name (not user name).

The calculation in the privilege set test whether the account name of the current user matches the account name of the record.

Get( AccountName ) = AccountName

Assign this privilege set to the users who need the limited access. You'll need to create an admin account (or use the full access account) so that records can be changed and assigned to other users.

[Steven H. Blackwell]

Further to Vaughan's excellent suggestions, also search for Record Level Access.

Steven

[Luke Daniel]

Ok. I think I understand what you're saying, but I'm having trouble implimenting it.

I've got clients case notes set up on a different table so while I'm hoping that all fm users/accountnames will have access to clients general information, only the note inputer will will have access to the case notes.

So...

I've got a field in both the general infor table and the casenote table that calls on the accountname.

However, when I try and ser a custom permission as you describe, eg "Get( AccountName ) = AccountName" to check who logeed the case note veres whos the logged in user attempting to access the case note fields, it says that the specified field cant be found. so that doesn't work.

I tried using "Get( AccountName ) = user" - which user is a field in the casenotes table which calls on the accountname, it wont work.

What am I missing here?

[Luke Daniel]

ok. i think I've worked this out!.

thanks so much guys.