Dynamic List and Security Issue

Question

Hi
I have a Dynamic List Wizard for orders, which the user can click on edit to edit or modify the order and if the user choose "Yes" to submit ( the order form has a submit filed which has Yes / No Values)then the EDIT button disappear and the user has no more control on the record(using show if conditional Region server behavior).
- Now i noticed that when i click on the edit the address bar includes the (www.mysite.com/form.php?order_id=1) now say the order Number 2 is already submitted (still on the list but no Edit button for it) if i write 3 or 4 or any other number instead of 1 at the address bar (www.mysite.com/form.php?order_id=3) the record which has the order number 3 displays on the screen and then you can edit it and when click update the Edit Button becomes Active which destroy the whole concept.
so, how to fix that?

Answer 1

Hi Lorie,
Taking it a step further
interesting that you´re mentioning this -- because I was just in the middle of finding a workaround for the very same issue ;-)
I actually did find a pretty easy solution, which basically goes like this:
1) wrap the whole table *plus* any possibly added hidden fields located below this table in a "Show IF conditional region" behaviour -- but make sure to *not* include the buttons within the "KT_bottombuttons" div in here.
2) as I assume that your "supplier_name" column holds a numeric value which equals the user´s "kt_login_id" Session Variable (which it should !), define the following conditions for the "Show IF conditional region" behaviour:
Expression 1: choose "supplier_name" from the tNG recordset
Condition: ==
Expression 2: choose Session -> kt_login_id
3) tick the Has ELSE option
4) confirm with OK
5) replace the default "has Else" message with something meaningful like "you can´t edit this record !"
Switching to Code view and navigating to the very start of your "Show IF conditional region" should display something like this:
if (@$row_rsqueryname['supplier_name'] == @$_SESSION['kt_login_id']) {
When viewing the modified Dynamic Form in a browser, you´ll note that this solution will indeed display the form instances for all "authorized" records, whereas those form instances which don´t match the required credentials will be replaced with that "has else" message.
BUT !! This solution has one major drawback which I haven´t been able to resolve yet :: when the Dynamic Form goes into Insert Record mode
(means when you click the "add new" link in the Dynamic List), all inner form instances will display that "has else" message.
The only workaround I currently can come up with is to have the List´s "add new" link point to a separate "add_new.php" page that´s going to insert a single record.
Cheers,
Günter Schenk
Adobe Community Expert, Dreamweaver