Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 4.0

Hi, All:

Refer to the instruction in in Showing Process Instance (List Record) Data in a Form.

I found user just need to change the id number in the url, then he can see all the content of the forms that was applied submited by other people.

For example :

http://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21162_leaveApp_applyLeaveProcessImage Removed

http://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21163_leaveApp_applyLeaveProcess

httpapplyLeaveProcesshttp://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21164_leaveApp_applyLeaveProcessHowImage RemovedapplyLeaveProcess

How can I prevent this ? 

Appreciate your kindly help.

...