AnsweredAssumed Answered

External File Access Security Issue

Question asked by carojo on Jul 9, 2014
Latest reply on Jul 15, 2014 by carojo

I've recently been revisiting the issue / solution posted in previous discussion and further testing has revealed a problem - (see Restricting External File Access issue)


To recap (this is in FM12 server evironment):


User1 has unlimited access to File 1 (not under my control - developer inexperienced and has granted Full Access privilege to all users of File 1) and restricted access to my file (File 2) ie same login details allow read only / view only for File 2 records belonging to their group.


To enable ease of access from File 1 to File 2 I have applied the re-login step as suggested previously (though the issue occurs regardless of this point) - which logs them into File 2 as User1_ with a hidden password - privilege set for this user has edit access to File 2 records belonging to their group.


The problem is that once they have been re-logged in to File 2 with edit access, they can then go back to File 1 and access / update any fields in File 2 using layouts based on table occurrences for File 2 - which bypasses all of the restrictions & validation in my solution!


So it's really back to the drawing board for me!


I now can't see a way to safely allow access to my solution from File 1 at all (other than locking down security at the field level and making all updates through scripts which would be a major headache), so any advice or insights much appreciated - this is still in FM12 but I don't think it would be any different in version 13.


(It would be nice if FileMaker offered a bit more granularity in how access from other files is managed rather than all or nothing!)


Thanks in advance