Joget DX 8 Stable Released

The stable release for Joget DX 8 is now available, with a focus on UX and Governance.

Risk of Showing Process Instance (List Record) Data in a Form.

Created by Jonathan Yang on Aug 01, 2013

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Hi, All:

Refer to the instruction in Showing Process Instance (List Record) Data in a Form.

I found user just need to change the id number in the url, then he can see all the content of the forms that was applied by other people.

For example :http://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21162_leaveApp_applyLeaveProcess http://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21163_leaveApp_applyLeaveProcesshttp://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21164_leaveApp_applyLeaveProcessHow can I prevent this ?

Appreciate your kindly help.

Best Regards
Jonathan Yang

No labels