[security issue?] Hide fields data from web source code

The best way for me to quickly describe how these roles work is to share an example:

In this app, people can be active (good standing) or inactive (bad standing, have been banned by an admin). I’m clarifying this twice with “Current User is This User” to cover both scenarios.

Admins have more privileges, namely the ability to view all fields and auto-bind certain fields. This is similar to your admin privacy role except I’m also checking to see if the person is logged in and active.

People’s accounts that do not belong to the current user are protected by specifying “Current User is not This User” and restricting access, in my case this is 1 of 2 roles like this which is meant for people who decide they want to keep their profile private.

Similar to the previous example, here we have slightly different visibility on the fields for people who choose to have a public profile while still keeping “Current User is not This User”.

TLDR; It’s important to cover all potential scenarios for Data Types. In my case that means: users who are active and this account belongs to them, users who are inactive and this account belongs to them, users who are admins and this account is both active and belongs to them, private users who are not the current account owner, and public users who are not the current account owner.

3 Likes