8 Replies Latest reply on Mar 3, 2009 8:39 AM by TSGal

    access privilege issue in filemaker 10 pro

    csavage

      Summary

      access privilege issue in filemaker 10 pro

      Description of the issue

      FileMaker Product(s) involved:FileMaker Pro 10v1Operating System(s) involved:Windows Vista and Mac 10.4.11 Detailed description of the issue:Using the privilege set to limit edit access to certain records is producing wrong results.  We have two privilege sets created: TEST and TEST_MGT.  The following formula is being used to determine access to the records. Exact(Upper(priv_set);Upper( Get(PrivilegeSetName))) or Exact(Upper(Get(PrivilegeSetName));Upper("TEST_MGT")).  When a user is a member of the TEST_MGT group, they should have access to edit the records of both TEST and TEST_MGT.  When testing, the error message appears “Your access privileges do not allow you to perform this action.”    Exact steps to reproduce the issue:1.  Create a database2.  Create the following fields: field1, field2, field3, and priv_set. 3.  Create Privilege sets: TEST and TEST_MGT4.  Change File > Manage > Accounts and Privileges > Edit Privilege Set, click on Layouts. 5.  Change to All modifiable.6.  Click beside Records: Create, edit, and delete in all tables.7.  Change to custom privileges. 8.  Then click on edit for the given table name. At the bottom where set privileges: click on the drop down for edit and choose limited. 9.  Enter the above formula. Click OK to accept the changes.10. Repeat step 4-9, for privilege set TEST. 11. Click File > Manage > Accounts and Privileges > New. 12. For the Account Name and password, enter user1. Change Privilege set to TEST. Click Ok.13. For the Account Name and password, enter user2. Change Privilege set to TEST_MGT. Click Ok. 14. Create 3 records: record 1 should have TEST in the priv_set field; record 2 with TEST_MGT in the priv_set field; record 3 should have [Full Access] in the priv_set field. 14. Close the file. 15. Open the file with filemaker pro 10 using account user2 and password user2. Attempt to make changes to records 1 and 2. Expected Result:Filemaker Pro 10: Edit access should be given for records 1 and 2 using account user2. Actual Result:Filemaker Pro 10: No access is given to edit the records. Exact text of any error message(s) that appeared:“Your access privileges do not allow you to perform this action.”    Any additional configuration information/troubleshooting that is relevant to the issue:Using Filemaker Pro 9: Edit access should be given for records 1 and 2 using account user2.Using Filemaker Pro 9: Edit access is given to the records.    Open the file with filemaker pro 9 using account user2 and password user2. Attempt to make changes to records 1 and 2.  Access in given for editing records 1 and 2.

        • 1. Re: access privilege issue in filemaker 10 pro
          csavage
            

          Can I get a status if this is being looked into or not?

           

          Thank you in advance

          • 2. Re: access privilege issue in filemaker 10 pro
            TSGal

            csavage:

             

            Thank you for your post.

             

            When the limited access is created, the Get (PrivilegeSetName) is taken at the time it is created.  Therefore, this will always return "Full Access".

             

            Since it is not possible to have an "unstored" calculation in the privilege set name, you will need to do this from a field.

             

            Therefore, create a calculation field, "CALC", with the same formula:

            Exact ( Upper ( priv_set ) ; Upper ( Get ( PrivlegeSetName ) ) )

             

            Click on "Storage Options..." and check the box "Do not store calculation results -- recalculate when needed".

             

            Now, back in the calculation for the Limited privilege set, set it to the field "CALC".

             

            You will now get the desired results.

             

            TSGal

            FileMaker, Inc.

            • 3. Re: access privilege issue in filemaker 10 pro
              csavage
                

              Thank you for the response.

               

              We have tried the soultion you presented and received the same result.  Calc field evaluates to true but the application still returns the message "Your access privileges do not allow you to perform this action."  In Filemaker Pro 9, this same application returns true and allows the user to make changes.

               

              Create three user accounts for the file: Admin, user1, user2. Give user1 the privilege set of TEST.  Give user2 the privilege set of TEST_MGT.  Create one field for data, another field "priv_set" to hold data for a department name. The calc field should have this calculation assigned: Exact (Upper(priv_set) ; Upper(Get ( PrivilegeSetName )) ) or Exact (Upper(Get ( PrivilegeSetName )) ; Upper("TEST_MGT") ).  You want user2 to have access to TEST_MGT records as well as TEST records. 

               

              I have created a new database file that responses the same way as I have described.  I am willing to send it to you if needed.

              • 4. Re: access privilege issue in filemaker 10 pro
                TSGal

                csavage:

                 

                Oops.  My solution is wrong.  It definitely works in FileMaker Pro 9, but not in FileMaker Pro 10.  This was changed due to problems that occurred in FileMaker Pro 9.

                 

                I have tried the following workaround, and this appears to work.

                 

                1. Create a global text field (mine is called gAccess).

                 

                2. Create a script with the following command:

                Set Field [ <global field> ; Upper ( Get ( PrivilegeSetName ) ) ]

                 

                3. Under "File Options...", put a check mark in the option to Perform this script upon opening the file.

                 

                4. Now, under the calculation field I provided in an earlier post, change the calculation to:

                Exact ( Upper ( priv_set ) ; <global field> )

                 

                ------------- 

                 

                If you want user2 to also access TEST records, then you can modify the calculation to:

                 

                If ( <global field> = "TEST_MGT"; Exact ( Upper ( priv_set ) ; <global field> ) or Exact ( Upper ( priv_set ) ; "TEST" ) ;

                    Exact ( Upper ( priv_set ) ; <global field> ) )

                 

                 

                TSGal

                FileMaker, Inc. 

                • 5. Re: access privilege issue in filemaker 10 pro
                  csavage
                    

                  Thanks for the solution.

                   

                  I am curious to know what changes were made due to problems to Filemaker Pro 9 that you are referring.  

                   

                   

                  Thanks again.

                  • 6. Re: access privilege issue in filemaker 10 pro
                    TSGal

                    csavage:

                     

                    Glad to know it works.

                     

                    There were a couple of low-level access privilege problems reported with FileMaker Pro 9 when using FileMaker Server 9.  Nothing serious, but it caused some incorrect results at times.

                     

                    TSGal

                    FileMaker, Inc. 

                    • 7. Re: access privilege issue in filemaker 10 pro
                      Jiran
                        

                      Hello.

                       

                      We have encountered the same bug. However your solution works, I cannot agree that this would be the right or desired behavior of  Get(PrivilegeSetName) function in Record Access Privileges.

                       

                      I have always assumed (and the available documentation supports it) that Get() functions are always evaluated on demand. This works with Get(AccountName) and Get(ExtendedPrivileges) and I have no clue why Get(PrivilegeSetName) should behave otherwise.

                       

                      It also seems to me, that Get(PrivilegeSetName) is in fact evaluated at the time of record access privileges evaluation, but it returns [Full Access] in result of FileMaker trying to mimic this PrivilegeSet to avoid wrong privilege evaluation when based on related fields which could be seen in FileMaker Server 9.

                       

                      Another thing is that however your workarround works with global field, it does not work using global variable instead when hosted on FileMaker Server 10. Is there an issue in FMS priv set calculation engine?

                       

                      Thank you for your workarround. We will have to implement it in order to have our databases working, I would also like to have some more light shed into this filed though.

                       

                      Jiri Lunacek

                      24U Software

                      Czech Republic 

                      • 8. Re: access privilege issue in filemaker 10 pro
                        TSGal

                        Jiran:

                         

                        Thank you for your post.

                         

                        Please read the Knowledge Base article #7161:

                         

                        http://filemaker.custhelp.com/cgi-bin/filemaker.cfg/php/enduser/std_adp.php?p_faqid=7161

                         

                        This will give you some insight on why it is this way.

                         

                        TSGal

                        FileMaker, Inc.