Code On Time: Security

Friday, January 4, 2013Print Subscribe

Displaying Current User Name as a Virtual Field

Suppose that you need to display the name of the current user. Let’s implement a virtual field that will display the current user name on the Customers form.

Start the Project Designer. In the Project Explorer, switch to the Controllers tab. Right-click on Customers / Fields node, and press New Field.

Use the following values:

Property	Value
Name	CurrentUserName
Type	String
Length	40
Allow null values.	true
The value of this field is computed at run-time by SQL expression.	true
SQL Formula	@BusinessRules_UserName
Label	Current User
Values of this field cannot be edited.	true

Press OK to save.

Let’s add this field to the edit form. Drop Customers / Fields / CurrentUserName (String(40)), read-only) node onto Customers / Views / editForm1 node. This will instantiate a CurrentUserName data field.

On the toolbar, press Browse. Navigate to the Customers page and select a record. The Current User data field will display the user name at the bottom of the form.

Log out, and log in as user / user123%. The current user will change to reflect the current user account.

Labels: Application Builder, Security, User Interface, Web Application Generator

Thursday, January 3, 2013Print Subscribe

Restrict Access to Fields with “Roles” Properties

The Read Roles and Write Roles properties for a field allow specifying a list of roles. Users that do not have a role in the list will not be able to view or edit the field, respectively.

Let’s prevent non-administrators from editing the Phone field in Customers controller or viewing the Address fields.

Controlling Editing Rights for Phone Field

Start the Project Designer. In the Project Explorer, switch to the Controllers tab. Double-click on Customers / Fields / Phone node.

Change the Write Roles property:

Property	New Value
Write Roles	Administrators

Press OK to save.

Controlling Visibility for Address Fields

Double-click on Customers / Fields / Address (String(60)) node.

Change the following:

Property	New Value
Read Roles	Administrators

Press OK to save. Make the same change to these fields as well: City, Region, PostalCode, Country.

Viewing the Results

On the toolbar, press Browse.

Log in with the standard user account (user / user123%) and navigate to the Customers page. Note that none of the address fields are displayed in the grid.

Select a record and start editing. Note that the Phone field is read-only.

Log out, and log in again with the administrative account (admin / admin123%). Start editing a record – Phone and Address fields will be editable.

Labels: Application Builder, Security, User Interface, Web Application Generator

Thursday, January 3, 2013Print Subscribe

Restrict Access to Actions with “Roles” Property

It is possible to restrict access to actions by a specified list of roles. If the current user is not in the list of roles, the action will not be displayed in the user interface.

For example, the Actions | Export to Spreadsheet option in the Orders controller is available to all registered users by default.

Let’s restrict access to this action to only users with roles of “Administrators” or “Sales Manager”.

Start the Project Designer. In the Project Explorer, switch to the Controllers tab and double-click on Orders / Actions /ag5 (ActionBar) – Actions / a3 – ExportRowset node.

Change the Roles property:

Property	Value
Roles	Administrators, Sales Manager

Press OK to save. On the toolbar, press Browse.

Log in with the standard user account (user / user123%) and navigate to the Orders page. The Export to Spreadsheet action will not longer be available.

Log out, and log in again with the administrative account (admin / admin123%). The action will be available.

Labels: Application Factory, Security, User Interface, Web Application Generator