Solved

Row-level Security Doesn't Restrict File Attachments on Entities that are Restricted?

  • 1 December 2022
  • 3 replies
  • 103 views

Userlevel 2

In testing Row-level Security to restrict users from accessing certain Customers and their related transactions, I found that if you attach any files to a Customer’s transactions those files are visible and accessible via Search for users who are actually restricted from those Customers.  Even though the restricted users can’t see or access the Customer and their transactions they can see all file attachments to those Customers and transactions that are restricted.

The only way I can tell to address this hole is to restrict access to the File Maintenance screen to all users and hope that plugs the hole and doesn’t restrict them from adding attachments to records.  Testing will hopefully produce results in our favor.

Anyone run into this before and have a strong understanding on how to work with it so that attachments follow the same Row-level Restrictions as the Entities and Records they are attached to?

icon

Best answer by darinpaulsacumatica76 8 December 2022, 22:33

View original

3 replies

Userlevel 3
Badge

@darinpaulsacumatica76 

We are looking into the same question.

We need to restrict people form seeing confidential attachments.

Thank you!

Userlevel 2

@mstuber64 

It seems that, at least in recent versions, the files attached to the Entity in the Restriction, in our case Customers, are indeed blocked from Users not in the Restriction Group.  The Transaction attachments are not.  We were able to restrict access to “File Maintenance” to block those restricted users from Files attached to Transactions and it did NOT prevent them from attaching their own files to the Entities they are allowed access to, but of course will restrict them from any actions that the File Maintenance Screen provides such as version management, deleting files, etc.  See if you can confirm the same.

Userlevel 3
Badge

@darinpaulsacumatica76 

Thank you for this additional information.

Once our customer decides how they want to handle the security and we are able to test this, I will get back to you with the results.

 

Reply


About Acumatica ERP system
Acumatica Cloud ERP provides the best business management solution for transforming your company to thrive in the new digital economy. Built on a future-proof platform with open architecture for rapid integrations, scalability, and ease of use, Acumatica delivers unparalleled value to small and midmarket organizations. Connected Business. Delivered.
© 2008 — 2024  Acumatica, Inc. All rights reserved