Jump to content

securing user input


This topic is 5305 days old. Please don't post here. Open a new topic instead.

Recommended Posts

Okay, well I've just found this super helpful forum on the web so I'm hoping i can take advantage of it!

I work for an NGO in social services and am looking to develop a clients case notes database.

I currently have three tables. one for casenotes, one for general info, and one for account keeping info.

I'd like to secure information in the case notes table based upon the Id of the person who lodged the case note.

How could I do this? I have currently created just 2 user accounts to play around with and want to set it so if user 1 has been assigned client X, the only user 1 can read and edit there case notes. other users should have access to other tables information...

possible? I'm guessing so.

Link to comment
Share on other sites

Yes, very possible.

Read up on creating privilege sets and record level access privileges.

Also read up on the Get( AccountName ) function.

Basically, each record needs an "AccountName" field that stores the account name of the person who lodged the case note. This should be a text field that auto-enters the account name (not user name).

The calculation in the privilege set test whether the account name of the current user matches the account name of the record.

Get( AccountName ) = AccountName

Assign this privilege set to the users who need the limited access. You'll need to create an admin account (or use the full access account) so that records can be changed and assigned to other users.

Link to comment
Share on other sites

  • 2 weeks later...

Ok. I think I understand what you're saying, but I'm having trouble implimenting it.

I've got clients case notes set up on a different table so while I'm hoping that all fm users/accountnames will have access to clients general information, only the note inputer will will have access to the case notes.

So...

I've got a field in both the general infor table and the casenote table that calls on the accountname.

However, when I try and ser a custom permission as you describe, eg "Get( AccountName ) = AccountName" to check who logeed the case note veres whos the logged in user attempting to access the case note fields, it says that the specified field cant be found. so that doesn't work.

I tried using "Get( AccountName ) = user" - which user is a field in the casenotes table which calls on the accountname, it wont work.

What am I missing here?

Link to comment
Share on other sites

This topic is 5305 days old. Please don't post here. Open a new topic instead.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.