URL Data Breach

Ask for Help
1

I have a tool in my business to show ‘Team Leaders’ sensitive information regarding thir team members. The data is filtered to show to every ‘Team Leader’ the people who have the name of the team leader as ‘leader’.

image
image2119×742 46.5 KB

A work collegue has recently accessed the App through a URL saved in the browser History and accessed information regarding a person who he should not see. The data and the filters are correct as once my collegue moved to a different screen, he was no longer allowed to go back to the first screen.

To mitigate this i even put visibility conditions on the collections of data shown in the screen. But every time he accesses the app through that URL it’s like he bypasses all filters and conditions. Any idea how to solve this?

2

Sounds like they are accessing a specific details screen directly.

A quick (insecure) fix would probably be to apply visibility conditions to the components on the details screen.

To fix it properly you should apply Row Owners. You probably want to use Team Names as Roles (configured in User Profiles), and then use the Role names as Row Owners in your data table.

3 Likes
3

Thank you so much Darren! everything works now

4

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.